Unrated severityNVD Advisory· Published Jun 10, 2015· Updated May 6, 2026
CVE-2015-4171
CVE-2015-4171
Description
strongSwan 4.3.0 through 5.x before 5.3.2 and strongSwan VPN Client before 1.4.6, when using EAP or pre-shared keys for authenticating an IKEv2 connection, does not enforce server authentication restrictions until the entire authentication process is complete, which allows remote servers to obtain credentials by using a valid certificate and then reading the responses.
Affected products
39cpe:2.3:a:strongswan:strongswan:4.3.0:*:*:*:*:*:*:*+ 33 more
- cpe:2.3:a:strongswan:strongswan:4.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:4.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:4.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:4.3.3:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:4.3.4:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:4.3.5:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:4.3.6:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:4.3.7:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:4.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:4.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:4.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:4.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:4.5.2:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:4.5.3:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:4.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:4.6.1:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:4.6.2:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:4.6.3:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:4.6.4:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:5.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:5.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:5.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:5.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:5.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:5.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:5.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:5.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:5.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:5.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:5.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:5.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:5.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:5.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:5.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan_vpn_client:*:*:*:*:*:android:*:*Range: <=1.4.5
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*+ 2 more
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:14.10:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:15.04:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
12- www.debian.org/security/2015/dsa-3282nvdPatch
- www.ubuntu.com/usn/USN-2628-1nvdPatch
- play.google.com/store/apps/detailsnvdPatch
- www.strongswan.org/blog/2015/06/08/strongswan-vulnerability-%2528cve-2015-4171%2529.htmlnvdPatchVendor Advisory
- lists.opensuse.org/opensuse-updates/2015-06/msg00040.htmlnvd
- www.openwall.com/lists/oss-security/2015/05/29/6nvd
- www.openwall.com/lists/oss-security/2015/05/29/7nvd
- www.openwall.com/lists/oss-security/2015/06/08/4nvd
- www.securityfocus.com/bid/74933nvd
- www.securitytracker.com/id/1032514nvd
- bugzilla.suse.com/show_bug.cginvd
- www.suse.com/security/cve/CVE-2015-4171.htmlnvd
News mentions
0No linked articles in our index yet.