ID

VAR-200412-0107

CVE

CVE-2004-0369

TITLE

Entrust LibKMP ISAKMP Library Remote IPsec/ISAKMP Buffer Overflow Vulnerability

DESCRIPTION

Buffer overflow in Entrust LibKmp ISAKMP library, as used by Symantec Enterprise Firewall 7.0 through 8.0, Gateway Security 5300 1.0, Gateway Security 5400 2.0, and VelociRaptor 1.5, allows remote attackers to execute arbitrary code via a crafted ISAKMP payload. The Entrust LibKMP ISAKMP library is reported to be affected by a remote buffer overflow vulnerability. Malicious ISAKMP packets may trigger a buffer overrun in the affected library resulting in the corruption of process memory. Although unconfirmed, it is conjectured that this vulnerability may be related to the vulnerability described in BID 10273, as Checkpoint VPN-1 may use the affected library. The Entrust LibKmp ISAKMP library is used by multiple VPN vendors to exchange IKE keys for IPSEC-based VPN products. libKmp handles all incoming ISAKMP packets, this library is also used to authenticate and check the processing of incoming requests. The Entrust LibKmp ISAKMP library does not correctly verify incoming ISAKMP packets when implementing the IKE key exchange protocol. Entrust\'\'s LibKmp library is provided by the vendor to third parties to handle the exchange of IKE keys. This library is used in several enterprise firewall VPN products. Entrust\'\'s LibKmp library is fully checked for handling ISAKMP payloads and sizes. But the proposal payload embedded in the main SA payload is not properly filtered. The code that handles these loads has a flaw that can lead to memory corruption, a heap overflow. An attacker exploits this vulnerability to send malicious ISAKMP packets, which can cause the VPN component to crash, and carefully constructed and submitted data may execute arbitrary instructions on the system with process privileges. Product: Symantec Gateway Security 2.0 - Model 5400 Series Copyright \xa9 2004 Symantec Corporation August, 2004 ************************************************************************************ Hotfix: SG8000-20040715-00 - Entrust updates ************************************************************************************ This document contains the following information about the Symantec Gateway Security 2.0 - Model 5400 Series: * Prerequisites * Included modules * Fix description * Installation instructions * Uninstallation instructions ************************************************************************************ Prerequisites: HB8000-20031023-00 - December 2003 patch SG8000-20040405-00 - April 2004 patch ************************************************************************************ Included modules: isakmpd libEntrust.so libkmp.so ************************************************************************************ Fix description: Corrects problem with Denial of Service attack reported against isakmpd in CAN-2004-0369. ************************************************************************************ Installation instructions: The April 2004 patch must be installed prior to installing this hotfix. To install the patch 1. Download the entrust-sgs20.tgz file to a location that is accessible from the Security Gateway Management Interface (SGMI). 2. In the SGMI, on the Action menu, click HotFix. 3. In the left pane of the Hotfix Management window, click Install hotfix. 4. In the right pane of the Hotfix Management window, click Browse. 5. In the Choose file dialog box, browse to and select the entrust-sgs20.tgz file, and then click Open. 6. In the right pane of the Hotfix Management window, click Install. 7. Wait until a message appears in the right pane of the Hotfix Management window. (Note: there is no visible indication of activity.) 8. If the message includes a "Restart" link, click the link and wait until the "Security gateway is restarting" message appears. 9. Close the Hotfix Management window. ************************************************************************************ Uninstallation instructions: To uninstall the patch 1. In the SGMI, on the Action menu, click HotFix. 2. In the left pane of the Hotfix Management window, click Uninstall hotfix. 3. In the right pane of the Hotfix Management window, click the radio button next to hotfix ID SG8000-20040715-00. 4. In the right pane of the Hotfix Management window, click Uninstall. 5. Wait until a message appears in the right pane of the Hotfix Management window. (Note: there is no visible indication of activity.) 6. If the message includes a "Restart" link, click the link and wait until the "Security gateway is restarting" message appears. 7. Close the Hotfix Management window. ************************************************************************************ . Connect to Symantec Gateway Security (SGS) using the SRMC. Connect to the VelociRaptor using the SRMC. Right-click the VelociRaptor icon. Browse to the location of the *.tgz file. Select Open to load the patch. Answer "No" when asked if you want to reboot the system. Connect to the VelociRaptor using the SRMC. Right-click the VelociRaptor. Select All Tasks > SRL Client. Log into the system. Type: cd /usr/vr/hotfixes/SG7004-20040715-00 and press Enter. Type: ./Uninstall and press Enter

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

Boundary Condition Error

CONFIGURATIONS

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Mark Dowd Neel Mehta

SOURCES

LAST UPDATE DATE

2024-08-14T14:08:57.818000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE