CVE-2015-4171

strongSwan 4.3.0 through 5.x before 5.3.2 and strongSwan VPN Client before 1.4.6, when using EAP or pre-shared keys for authenticating an IKEv2 connection, does not enforce server authentication restrictions until the entire authentication process is complete, which allows remote servers to obtain credentials by using a valid certificate and then reading the responses.

• CWE-200

• http://lists.opensuse.org/opensuse-updates/2015-06/msg00040.html
• http://www.debian.org/security/2015/dsa-3282Patch
• http://www.openwall.com/lists/oss-security/2015/05/29/6
• http://www.openwall.com/lists/oss-security/2015/05/29/7
• http://www.openwall.com/lists/oss-security/2015/06/08/4
• http://www.securityfocus.com/bid/74933
• http://www.securitytracker.com/id/1032514
• http://www.ubuntu.com/usn/USN-2628-1Patch
• https://bugzilla.suse.com/show_bug.cgi?id=933591
• https://play.google.com/store/apps/details?id=org.strongswan.androidPatch
• https://www.strongswan.org/blog/2015/06/08/strongswan-vulnerability-%2528cve-2015-4171%2529.htmlPatch, Vendor Advisory
• https://www.suse.com/security/cve/CVE-2015-4171.html
• http://lists.opensuse.org/opensuse-updates/2015-06/msg00040.html
• http://www.debian.org/security/2015/dsa-3282Patch
• http://www.openwall.com/lists/oss-security/2015/05/29/6
• http://www.openwall.com/lists/oss-security/2015/05/29/7
• http://www.openwall.com/lists/oss-security/2015/06/08/4
• http://www.securityfocus.com/bid/74933
• http://www.securitytracker.com/id/1032514
• http://www.ubuntu.com/usn/USN-2628-1Patch
• https://bugzilla.suse.com/show_bug.cgi?id=933591
• https://play.google.com/store/apps/details?id=org.strongswan.androidPatch
• https://www.strongswan.org/blog/2015/06/08/strongswan-vulnerability-%2528cve-2015-4171%2529.htmlPatch, Vendor Advisory
• https://www.suse.com/security/cve/CVE-2015-4171.html

Published

Jun 10, 2015

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-4164The compat_iret function in Xen 3.1 through 4.5 iterates the…
• CVE-2015-4165The snapshot API in Elasticsearch before 1.6.0 when another …
• CVE-2015-4166Cloudera Key Trustee Server before 5.4.3 does not store keys…
• CVE-2015-4167The udf_read_inode function in fs/udf/inode.c in the Linux k…
• CVE-2015-4169Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2015-4170Race condition in the ldsem_cmpxchg function in drivers/tty/…
• CVE-2015-4173Unquoted Windows search path vulnerability in the autorun va…
• CVE-2015-4174Cross-site scripting (XSS) vulnerability in the integrated w…
• CVE-2015-4176fs/namespace.c in the Linux kernel before 4.0.2 does not pro…
• CVE-2015-4177The collect_mounts function in fs/namespace.c in the Linux k…
• CVE-2015-4178The fs_pin implementation in the Linux kernel before 4.0.5 d…
• CVE-2015-4179Multiple cross-site request forgery (CSRF) vulnerabilities i…