CVE-2009-0790 json
The pluto IKE daemon in Openswan and Strongswan IPsec 2.6 before 2.6.21 and 2.4 before 2.4.14, and Strongswan 4.2 before 4.2.14 and 2.8 bef…
published 2009-04-01 17 y ago modified 2026-06-16 4 mo ago also EUVD-2009-0788
- cvss
- 5.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 3.2%
- EPSS 3.2% chance of exploitation in 30 days, percentile 88%
- public exploits
- 0
- none known
Summary
The pluto IKE daemon in Openswan and Strongswan IPsec 2.6 before 2.6.21 and 2.4 before 2.4.14, and Strongswan 4.2 before 4.2.14 and 2.8 before 2.8.9, allows remote attackers to cause a denial of service (daemon crash and restart) via a crafted (1) R_U_THERE or (2) R_U_THERE_ACK Dead Peer Detection (DPD) IPsec IKE Notification message that triggers a NULL pointer dereference related to inconsistent ISAKMP state and the lack of a phase2 state association in DPD.
Patch / fix
- strongswan Debian 14, Debian 13, Debian 12 4.2.14-1
debian advisories DEBIAN-CVE-2009-0790
- openswan RHEL 5 2.6.14-1.el5_3.2
red hat advisories RHSA-2009:0402
- strongswan openSUSE Tumbleweed 5.3.5-1.1
opensuse advisories openSUSE-SU-2024:10579-1
- securityfocus.com/bid/34296 patch
- debian.org/security/2009/dsa-1759 advisory
- debian.org/security/2009/dsa-1760 advisory
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2009-0790 updated cvss 5.0
openswan: ISAKMP DPD remote DoS
-
Red Hat Enterprise Linux (v. 5 server) openswan 2.6.14-1.el5_3.2 Red Hat Enterprise Linux Desktop (v. 5 client) openswan 2.6.14-1.el5_3.2fixed: vendor fix RHSA-2009:0402
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
3.21% chance of exploitation in the next 30 days, higher than 88% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P |
Classification
- Weakness
-
- CWE-20 Improper Input Validation
References
-
debian.org
/security/2009/dsa-1759
vendor-advisory, patch
-
debian.org
/security/2009/dsa-1760
vendor-advisory, patch
-
securityfocus.com
/bid/34296
vdb-entry, patch
-
lists.opensuse.org
/opensuse-security-announce/2009-04/msg00010.html
vendor-advisory
-
redhat.com
/support/errata/RHSA-2009-0402.html
vendor-advisory
-
secunia.com
/advisories/34494
third-party-advisory, vendor-advisory
-
secunia.com
/advisories/34472
third-party-advisory, vendor-advisory
-
secunia.com
/advisories/34546
third-party-advisory, vendor-advisory
-
secunia.com
/advisories/34483
third-party-advisory, vendor-advisory
-
openswan.org
/CVE-2009-0790/CVE-2009-0790.txt
vendor-advisory
-
download.strongswan.org
/CHANGES4.txt
vendor-advisory
-
exchange.xforce.ibmcloud.com
/vulnerabilities/49523
vdb-entry
-
oval.cisecurity.org
/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11171
vdb-entry, signature
-
vupen.com
/english/advisories/2009/0886
vdb-entry
-
securitytracker.com
/id?1021949
vdb-entry
-
securityfocus.com
/archive/1/502270/100/0/threaded
mailing-list
-
securitytracker.com
/id?1021950
vdb-entry
Sources
- CVE List CVE-2009-0790
- NVD CVE-2009-0790
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.