CVE-2009-1957
Status: ModifiedMedium (5)—
charon/sa/ike_sa.c in the charon daemon in strongSWAN before 4.3.1 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an invalid IKE_SA_INIT request that triggers "an incomplete state," followed by a CREATE_CHILD_SA request.
CVSS
- Version: 2.0
- Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
- Base score: 5
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 2.95%
- Percentile among all scored CVEs: 87
- Score date: 10/6/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (1)
CWEs
- CWE-399
References
- http://download.strongswan.org/CHANGES4.txt
- http://download.strongswan.org/patches/03_invalid_ike_state_patch/strongswan-4.x.x_invalid_ike_state.patch
- http://download.strongswan.org/patches/03_invalid_ike_state_patch/strongswan-4.x.x_invalid_ike_state.readme
- http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html
- http://secunia.com/advisories/35296
- http://secunia.com/advisories/35685
- http://secunia.com/advisories/36922
- http://www.debian.org/security/2009/dsa-1899
- http://www.securityfocus.com/bid/35178
- https://lists.strongswan.org/pipermail/users/2009-May/003457.html
- http://download.strongswan.org/CHANGES4.txt
- http://download.strongswan.org/patches/03_invalid_ike_state_patch/strongswan-4.x.x_invalid_ike_state.patch
- http://download.strongswan.org/patches/03_invalid_ike_state_patch/strongswan-4.x.x_invalid_ike_state.readme
- http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html
- http://secunia.com/advisories/35296
- http://secunia.com/advisories/35685
- http://secunia.com/advisories/36922
- http://www.debian.org/security/2009/dsa-1899
- http://www.securityfocus.com/bid/35178
- https://lists.strongswan.org/pipermail/users/2009-May/003457.html
Raw JSON (NVD)
Show
{
"id": "CVE-2009-1957",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 5,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"authentication": "NONE",
"integrityImpact": "NONE",
"accessComplexity": "LOW",
"availabilityImpact": "PARTIAL",
"confidentialityImpact": "NONE"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 10,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2009-06-08T01:00:00.733",
"references": [
{
"url": "http://download.strongswan.org/CHANGES4.txt",
"tags": [
"Patch"
],
"source": "cve@mitre.org"
},
{
"url": "http://download.strongswan.org/patches/03_invalid_ike_state_patch/strongswan-4.x.x_invalid_ike_state.patch",
"tags": [
"Patch"
],
"source": "cve@mitre.org"
},
{
"url": "http://download.strongswan.org/patches/03_invalid_ike_state_patch/strongswan-4.x.x_invalid_ike_state.readme",
"tags": [
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html",
"source": "cve@mitre.org"
},
{
"url": "http://secunia.com/advisories/35296",
"source": "cve@mitre.org"
},
{
"url": "http://secunia.com/advisories/35685",
"source": "cve@mitre.org"
},
{
"url": "http://secunia.com/advisories/36922",
"source": "cve@mitre.org"
},
{
"url": "http://www.debian.org/security/2009/dsa-1899",
"source": "cve@mitre.org"
},
{
"url": "http://www.securityfocus.com/bid/35178",
"source": "cve@mitre.org"
},
{
"url": "https://lists.strongswan.org/pipermail/users/2009-May/003457.html",
"source": "cve@mitre.org"
},
{
"url": "http://download.strongswan.org/CHANGES4.txt",
"tags": [
"Patch"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://download.strongswan.org/patches/03_invalid_ike_state_patch/strongswan-4.x.x_invalid_ike_state.patch",
"tags": [
"Patch"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://download.strongswan.org/patches/03_invalid_ike_state_patch/strongswan-4.x.x_invalid_ike_state.readme",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/advisories/35296",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/advisories/35685",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/advisories/36922",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.debian.org/security/2009/dsa-1899",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/bid/35178",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://lists.strongswan.org/pipermail/users/2009-May/003457.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-399"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "charon/sa/ike_sa.c in the charon daemon in strongSWAN before 4.3.1 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an invalid IKE_SA_INIT request that triggers \"an incomplete state,\" followed by a CREATE_CHILD_SA request."
},
{
"lang": "es",
"value": "charon/sa/ike_sa.c del demonio charon de strongSWAN anterior a v4.3.1, permite a atacantes remotos provocar una denegación de servicio (referenca a puntero nulo y caída) a través de una solicitud IKE_SA_INIT no válida que provoca \"un estado incompleto\", seguido de una solicitud CREATE_CHILD_SA."
}
],
"lastModified": "2026-06-16T23:08:26.730",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:strongswan:strongswan:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A0771FD2-9FB2-4F00-AFB3-B44D124FC5C4",
"versionEndIncluding": "4.3.0"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:2.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A60B8687-A72A-4AF6-BDE9-795A1AC2F98B"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:2.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FD5EA677-BC73-4139-BF09-ADE65C2502A3"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:2.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "68B10EB8-0A5B-4C63-9A7D-2F034C286E6F"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:2.1.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3F13A264-EA51-4B92-B102-5316E45DB32F"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:2.1.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "406E1E6C-EA61-4FB8-9B0F-CE823046B09E"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:2.1.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F31D56AC-D037-42AE-B70F-C7700929DDD8"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:2.1.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "43A3A15C-122A-4564-A2E3-CB0E7C314797"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:2.1.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6806075C-2433-4CCB-919B-27979C79C8A1"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:2.1.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3809AE25-E840-4DB3-879E-F678305EC11B"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:2.2.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "959DA882-CC63-45F7-BF08-55F38DD8E999"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:2.2.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9313C88D-1C24-4623-87B4-ECA8285E28A2"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:2.2.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "08474171-A617-4163-BEAD-AA14F53A2BFC"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:2.3.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5516113A-F0F6-478F-95F7-9B4FB2DC68B6"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:2.3.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7D5E9376-3ED9-4A3D-83CE-7E1725F8F366"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:2.3.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "59BFC4CB-91E9-4181-A390-F0CE0D12EE2C"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:2.4.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "339E325D-B76C-400C-B332-7CA675C4F72B"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:2.4.0a:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F90373CD-E5C7-46BE-8C5F-22D3DE12A3E1"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:2.4.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6B8C12F9-A14F-4BC5-A2CC-18DADE8454C2"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:2.4.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C78E4DAD-B255-4666-927F-D82AC7396FE8"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:2.4.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9B602806-1420-4640-AD17-A2FEFDA6A967"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:2.4.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A203ADA7-54C9-4F37-A254-0A5378BB9B1F"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:2.5.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0E1C417F-C18A-4902-B409-09DD023974B3"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:2.5.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "235DBD81-E542-4FF7-A620-1872DC81D618"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:2.5.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "489F9DFA-5B24-4206-A306-0BAE849C2D2C"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:2.5.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "382D76A4-C2C6-4C1C-A0C0-757C372154DE"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:2.5.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E4BD021C-FDAC-4938-9390-D455577D30B5"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:2.5.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C90B1AC8-4C97-49B8-B82B-6F2FF295FDCA"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:2.5.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A977F561-D324-48EA-BAC5-66920F6BD584"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:2.5.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2EBD1B4B-E11F-46D0-A7AE-5E0749F6E216"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:2.6.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3D09EEB6-386C-4A73-BC08-4243BDC49EE9"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:2.6.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DBE3B5F4-063F-4AE9-B589-932751182101"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:2.6.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6AFD8D5D-7FB7-4B25-B1F2-7850348A6924"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:2.6.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "24F75943-1327-4868-88D5-917D06BCF5E5"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:2.6.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A4BE9083-EF34-4B1A-A139-E779E9704F88"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:2.6.16:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ABC07651-4412-40B7-A6C2-9CBCC010CBE9"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:2.6.20:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EC0D725F-4161-45BA-B1CE-99C2A75B7220"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:2.7.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0050370A-4CF0-4772-B287-DD05C5827E92"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:2.8.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5518A917-D5D1-4985-BF71-B1A34BD3D5B4"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:2.8.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "778D7442-F54A-47DF-B87B-3CFA3CF08799"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:2.8.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2A4B1F28-B3B8-4E31-8E4E-25F5A29F3AB3"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:2.8.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "16984E6E-7CA8-4DC3-B800-FFE007617FE4"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:2.8.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4C85F0BE-7E89-4B79-A036-9238785BE705"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:2.8.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8DFF4780-2F92-4DF3-878A-C7E2BD57E39C"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:2.8.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6C794994-9367-4BBB-8940-BBB44B7C1C5F"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:2.8.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "082272D3-0FE4-4959-978A-FFF795B52CA3"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:2.8.8:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8DFEF9B3-C7F7-4588-A174-FAFD39C04116"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:4.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "64C5AB11-3B59-4677-B544-28A22C413C72"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:4.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E595C454-4456-477A-BE51-75CEAB547E98"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:4.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6A40E983-4721-48FF-9EFB-702BA78DCB3A"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:4.0.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "59E7FA4C-69EE-4225-99FF-0EAB4A6C0049"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:4.0.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1DDF25EB-5509-4D79-8D26-A1CA1092089E"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:4.0.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A558368F-D9B1-49DF-A64F-95909A4EE7AE"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:4.0.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "74348E15-FF47-4B4D-B062-2EAE3141C84F"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:4.0.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "90985506-224F-4AE2-899E-93CA64025396"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:4.1.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BC3386A9-3740-4861-84B0-AAAC5C01378E"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:4.1.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F4E823F7-7162-440E-A113-7B1F437BF508"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:4.1.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1D1DEE61-13CB-4810-81B6-2AEBF13619CA"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:4.1.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D6D82E08-D6BF-41E3-9C3D-52552C8753CC"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:4.1.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CF06C431-DE35-4CCD-9DCE-ED9EE6A17464"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:4.1.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6C826191-A68F-4E02-945B-73F35AA580F0"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:4.1.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A316AF53-7E95-4E4F-8E50-22145F144CB4"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:4.1.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C7D3F068-778E-4BB7-AB22-368714BE1BFB"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:4.1.8:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "96330C24-C1AB-4B00-A3CC-5CCD291E0069"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:4.1.9:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BEF630C7-2AAB-4106-BAC9-AAE6FF278E15"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:4.1.10:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BF58206E-3086-45AC-91B6-032EF55D5552"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:4.1.11:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7D636603-65D5-45DB-AF7F-DD01B3932914"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:4.2.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "97027262-849C-4DE9-90C9-0D9FBBC9F96B"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:4.2.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8658539D-27D8-47EE-9468-A6B625E6D45F"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:4.2.10:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C41F9E10-000D-4F3B-BEA6-DEE87405B89B"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cve@mitre.org"
}