Ghost in the VPN: How a 15-Year-Old strongSwan Bug Lets Hackers Wreck Corporate Networks

It started like any other day for the IT team-until the company VPN collapsed without warning, leaving employees locked out and management scrambling for answers. The culprit? Not a cutting-edge cyber weapon, but a nearly forgotten bug lurking in strongSwan, one of the world’s most trusted open-source VPN platforms. Thanks to a simple math error coded over 15 years ago, attackers can now turn a minor oversight into a major disruption, and most organizations never saw it coming.

An Old Bug with New Impact

strongSwan is a backbone for many corporate and governmental VPNs, trusted for its reliability and transparency. But according to new research from Bishop Fox, a flaw first introduced over a decade ago can now be weaponized to crash entire networks. The bug sits quietly in the EAP-TTLS plugin-an authentication extension many organizations use to secure remote access.

The heart of the problem is an integer underflow-a classic programming mistake where software subtracts a larger number from a smaller one. In this case, when a hacker sends a tiny message (say, 1 byte) to a server expecting at least 8 bytes, the math doesn’t go negative. Instead, it wraps around to a gigantic positive number, causing the server’s memory allocation function to attempt to reserve up to 18 exabytes of RAM-an impossible feat for any machine.

But the attack doesn’t immediately set off alarms. Instead, the malicious packet corrupts the server’s memory management (the heap), but the VPN keeps running-at least for now. The real chaos erupts only when the next user tries to connect, triggering a delayed crash of the charon daemon (the software engine that powers the VPN). This two-step “ghost attack” makes tracing the cause a nightmare for defenders, who may never connect the dots between the original malicious packet and the eventual outage.

Who’s at Risk-and What to Do

Not every strongSwan installation is vulnerable: the flaw only affects systems with the EAP-TTLS plugin enabled and configured to accept IKEv2 connections. Still, with such configurations common in enterprise environments, the potential for widespread disruption is real. The fix is straightforward but urgent: update to strongSwan version 6.0.5 or newer. For those who don’t need EAP-TTLS, disabling the plugin is a smart interim measure.

Bishop Fox has released a testing tool that lets administrators check their exposure without risking a crash, offering a crucial lifeline for those unsure if their systems are at risk. As always, vigilance and timely patching remain the best defense against old bugs with new consequences.

In cybersecurity, yesterday’s mistakes can become tomorrow’s disasters. The strongSwan ghost attack is a sobering reminder: sometimes, the most dangerous threats are the ones hiding in plain sight, waiting for someone to do the math.

WIKICROOK

• Integer Underflow: Integer underflow happens when a calculation drops below an integer's minimum value, causing unexpected results and potential security vulnerabilities in software.
• EAP: EAP is a protocol framework enabling various authentication methods for secure network access, widely used in Wi-Fi and enterprise environments.
• Heap: The heap is a memory region for dynamic allocation, often targeted in cyberattacks due to improper memory management or vulnerabilities.
• Charon Daemon: Charon Daemon is strongSwan’s main process for managing VPN connections, handling authentication, key exchange, and secure tunnel creation using IKEv2.
• IKEv2: IKEv2 is a protocol that securely sets up and manages VPN connections by exchanging encryption keys and authenticating devices over the internet.