CVE-2009-2661
The asn1_length function in strongSwan 2.8 before 2.8.11, 4.2 before 4.2.17, and 4.3 before 4.3.3...
The asn1_length function in strongSwan 2.8 before 2.8.11, 4.2 before 4.2.17, and 4.3 before 4.3.3 does not properly handle X.509 certificates with crafted Relative Distinguished Names (RDNs), which allows remote attackers to cause a denial of service (pluto IKE daemon crash) via malformed ASN.1 data. NOTE: this is due to an incomplete fix for CVE-2009-2185.
Exploit likelihood
What each source reports
NVD Score used
The asn1_length function in strongSwan 2.8 before 2.8.11, 4.2 before 4.2.17, and 4.3 before 4.3.3 does not properly handle X.509 certificates with crafted Relative Distinguished Names (RDNs), which allows remote attackers to cause a denial of service (pluto IKE daemon crash) via malformed ASN.1 data. NOTE: this is due to an incomplete fix for CVE-2009-2185.
- Record
CVE-2009-2661- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-310
- Updated
- 2026-11-02
CVE List No score
The asn1_length function in strongSwan 2.8 before 2.8.11, 4.2 before 4.2.17, and 4.3 before 4.3.3 does not properly handle X.509 certificates with crafted Relative Distinguished Names (RDNs), which allows remote attackers to cause a denial of service (pluto IKE daemon crash) via malformed ASN.1 data. NOTE: this is due to an incomplete fix for CVE-2009-2185.
- Record
CVE-2009-2661- Updated
- 2026-11-02
EUVDEUVD-2009-2654 No score
The asn1_length function in strongSwan 2.8 before 2.8.11, 4.2 before 4.2.17, and 4.3 before 4.3.3 does not properly handle X.509 certificates with crafted Relative Distinguished Names (RDNs), which allows remote attackers to cause a denial of service (pluto IKE daemon crash) via malformed ASN.1 data. NOTE: this is due to an incomplete fix for CVE-2009-2185.
- Record
EUVD-2009-2654- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7j3p-ffqc-xjpg No score
The asn1_length function in strongSwan 2.8 before 2.8.11, 4.2 before 4.2.17, and 4.3 before 4.3.3...
The asn1_length function in strongSwan 2.8 before 2.8.11, 4.2 before 4.2.17, and 4.3 before 4.3.3 does not properly handle X.509 certificates with crafted Relative Distinguished Names (RDNs), which allows remote attackers to cause a denial of service (pluto IKE daemon crash) via malformed ASN.1 data. NOTE: this is due to an incomplete fix for CVE-2009-2185.
- Record
GHSA-7j3p-ffqc-xjpg- Updated
- 2026-11-02
OSV No score
The asn1_length function in strongSwan 2.8 before 2.8.11, 4.2 before 4.2.17, and 4.3 before 4.3.3 does not properly handle X.509 certificates with crafted Relative Distinguished Names (RDNs), which allows remote attackers to cause a denial of service (pluto IKE daemon crash) via malformed ASN.1 data. NOTE: this is due to an incomplete fix for CVE-2009-2185.
- Record
CVE-2009-2661- Updated
- 2026-11-02
OSVDEBIAN-CVE-2009-2661 No score
The asn1_length function in strongSwan 2.8 before 2.8.11, 4.2 before 4.2.17, and 4.3 before 4.3.3 does not properly handle X.509 certificates with crafted Relative Distinguished Names (RDNs), which allows remote attackers to cause a denial of service (pluto IKE daemon crash) via malformed ASN.1 data. NOTE: this is due to an incomplete fix for CVE-2009-2185.
- Record
DEBIAN-CVE-2009-2661- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
strongswanDebian:12 |
before 4.3.2-1.1 | 4.3.2-1.1 |
strongswanDebian:13 |
before 4.3.2-1.1 | 4.3.2-1.1 |
strongswanDebian:14 |
before 4.3.2-1.1 | 4.3.2-1.1 |
strongswanDebian:4.0 From an advisory covering 4 CVEs |
before 2.8.0+dfsg-1+etch2, plus listed versions 2.8.0+dfsg-12.8.0+dfsg-1+etch1 |
2.8.0+dfsg-1+etch2 |
strongswanDebian:5.0 From an advisory covering 4 CVEs |
before 4.2.4-5+lenny3, plus listed versions 4.2.4-54.2.4-5+lenny14.2.4-5+lenny2 |
4.2.4-5+lenny3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-2661 is a medium vulnerability (CVSS 5.0) in Strongswan, published August 4, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.58%, the 75th percentile. Fixed in strongswan 4.3.2-1.1.
References
openwall.com/lists/oss-security/2009/07/27/1
download.strongswan.org/patches/07_asn1_length_patch/strongswan-4.x.x_asn1_length.patch
lists.opensuse.org/opensuse-security-announce/2009-11/msg00004.html
secunia.com/advisories/36922
debian.org/security/2009/dsa-1899
vupen.com/english/advisories/2009/2247
Show 7 moreShow less
up2date.astaro.com/2009/08/up2date_7505_released.html
lists.strongswan.org/pipermail/announce/2009-July/000056.html
nvd.nist.gov/vuln/detail/CVE-2009-2661
github.com/advisories/GHSA-7j3p-ffqc-xjpg
security-tracker.debian.org/tracker/CVE-2009-2661