CVE-2018-16151

Vulnerability

The vulnerability resides in the verify_emsa_pkcs1_signature() function in gmp_rsa_public_key.c of the gmp plugin in strongSwan versions 4.x and 5.x prior to 5.7.0. The implementation fails to reject excess data after the encoded algorithm OID during PKCS#1 v1.5 signature verification, similar to a related flaw concerning digestAlgorithm.parameters. This affects all strongSwan installations where the gmp plugin is enabled and low-exponent RSA keys (e.g., e=3) are in use [1].

Exploitation

An attacker requires only a low public exponent (e=3) RSA key and the ability to present a crafted signature during IKEv2 authentication. By exploiting the lenient ASN.1 parsing that permits extra data after the OID, the attacker can forge a valid PKCS#1 v1.5 signature without needing any prior authentication or special network access [1].

Impact

Successful exploitation allows a remote attacker to forge RSA signatures, leading to impersonation of a legitimate peer when only RSA signature authentication is used for IKEv2. This can result in unauthorized access or man-in-the-middle attacks, compromising the confidentiality and integrity of IPsec connections [1][2].

Mitigation

The vulnerability is fixed in strongSwan version 5.7.0 and later. Users should upgrade to at least 5.7.0; Gentoo recommends upgrading to version 5.7.1 or later [1][2]. No workaround is available if the gmp plugin is enabled and low-exponent keys are in use.