ID

VAR-200511-0061

CVE

CVE-2005-3732

TITLE

IPSec-Tools IKE Message Handling Denial of Service Vulnerability

DESCRIPTION

The Internet Key Exchange version 1 (IKEv1) implementation (isakmp_agg.c) in racoon in ipsec-tools before 0.6.3, when running in aggressive mode, allows remote attackers to cause a denial of service (null dereference and crash) via crafted IKE packets, as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1. Numerous vulnerabilities have been reported in various Internet Key Exchange version 1 (IKEv1) implementations. The impacts of these vulnerabilities may allow an attacker to execute arbitrary code, cause a denial-of-service condition, or cause an IKEv1 implementation to behave in an unstable/unpredictable manner. ------------ This vulnerability information is a summary of multiple vulnerabilities released at the same time. Please note that the contents of vulnerability information other than the title are included. ------------ I SAKMP (Internet Security Association and Key Management Protocol) Authentication, key management, and SA (security association) of 3 A collective term for multiple protocols. ISAKMP Derived from IKE Is IPSec Key exchange protocol for encrypted communication. In many environments IKEv1 Is used. IKE Communication by phase 1 And phase 2 Divided into phases 1 Then establish a secure communication path, ISAKMP SA Called IKE Exchange own messages. In multiple products ISAKMP/IKE Implementation is illegal ISAKMP Phase 1 There is a problem that causes abnormal behavior when receiving this packet because there is a flaw in the processing of the packet. IKE When a deliberately created packet is sent by a remote attacker with specific information for communication by ISAKMP Services or devices that implement the may be in a service outage.Please refer to the “Overview” for the impact of this vulnerability. IPsec-Tools is prone to a denial-of-service vulnerability. This issue is due to a failure in the application to handle exceptional conditions when in 'AGGRESSIVE' mode. An attacker can exploit this issue to crash the application, thus denying service to legitimate users. These vulnerabilities were discovered by, and may be reproduced by, the University of Oulu Secure Programming Group PROTOS IPSec Test Suite. --------------------------------------------------------------------- Fedora Legacy Update Advisory Synopsis: Updated ipsec-tools package fixes security issue Advisory ID: FLSA:190941 Issue date: 2006-06-06 Product: Fedora Core Keywords: Bugfix CVE Names: CVE-2005-3732 --------------------------------------------------------------------- --------------------------------------------------------------------- 1. Topic: An updated ipsec-tools package that fixes a bug in racoon is now available. The ipsec-tools package is used in conjunction with the IPsec functionality in the linux kernel and includes racoon, an IKEv1 keying daemon. 2. Relevant releases/architectures: Fedora Core 2 - i386 Fedora Core 3 - i386, x86_64 3. Problem description: A denial of service flaw was found in the ipsec-tools racoon daemon. If a victim's machine has racoon configured in a non-recommended insecure manner, it is possible for a remote attacker to crash the racoon daemon. (CVE-2005-3732) Users of ipsec-tools should upgrade to this updated package, which contains backported patches, and is not vulnerable to this issue. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Please note that this update is also available via yum and apt. Many people find this an easier way to apply updates. To use yum issue: yum update or to use apt: apt-get update; apt-get upgrade This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. This assumes that you have yum or apt-get configured for obtaining Fedora Legacy content. Please visit http://www.fedoralegacy.org/docs for directions on how to configure yum and apt-get. 5. Bug IDs fixed: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=190941 6. RPMs required: Fedora Core 2: SRPM: http://download.fedoralegacy.org/fedora/2/updates/SRPMS/ipsec-tools-0.5-2.fc2.1.legacy.src.rpm i386: http://download.fedoralegacy.org/fedora/2/updates/i386/ipsec-tools-0.5-2.fc2.1.legacy.i386.rpm Fedora Core 3: SRPM: http://download.fedoralegacy.org/fedora/3/updates/SRPMS/ipsec-tools-0.5-2.fc3.1.legacy.src.rpm i386: http://download.fedoralegacy.org/fedora/3/updates/i386/ipsec-tools-0.5-2.fc3.1.legacy.i386.rpm x86_64: http://download.fedoralegacy.org/fedora/3/updates/x86_64/ipsec-tools-0.5-2.fc3.1.legacy.x86_64.rpm 7. Verification: SHA1 sum Package Name --------------------------------------------------------------------- fc2: e8f91c085fb9533106c6ebc442572bd0b22f2470 fedora/2/updates/i386/ipsec-tools-0.5-2.fc2.1.legacy.i386.rpm 292a0a1426bc75abf0b34a3c91279a40ea78aac2 fedora/2/updates/SRPMS/ipsec-tools-0.5-2.fc2.1.legacy.src.rpm fc3: e49b07bcc0e3dbe56401056b65b36133dabb4b6c fedora/3/updates/i386/ipsec-tools-0.5-2.fc3.1.legacy.i386.rpm 10eed18767204b88c2811115d889c0a372079ec2 fedora/3/updates/x86_64/ipsec-tools-0.5-2.fc3.1.legacy.x86_64.rpm 0832eb1da62b597bc32b26ce9e8429d7e67f43d2 fedora/3/updates/SRPMS/ipsec-tools-0.5-2.fc3.1.legacy.src.rpm These packages are GPG signed by Fedora Legacy for security. Our key is available from http://www.fedoralegacy.org/about/security.php You can verify each package with the following command: rpm --checksig -v <filename> If you only wish to verify that each package has not been corrupted or tampered with, examine only the sha1sum with the following command: sha1sum <filename> 8. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3732 9. Contact: The Fedora Legacy security contact is <secnotice@fedoralegacy.org>. More project details at http://www.fedoralegacy.org --------------------------------------------------------------------- . - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200512-04 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Openswan, IPsec-Tools: Vulnerabilities in ISAKMP Protocol implementation Date: December 12, 2005 Bugs: #112568, #113201 ID: 200512-04 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Openswan and IPsec-Tools suffer from an implementation flaw which may allow a Denial of Service attack. Background ========== Openswan is an implementation of IPsec for Linux. IPsec is widely used to secure exchange of packets at the IP layer and mostly used to implement Virtual Private Networks (VPNs). Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-misc/openswan < 2.4.4 >= 2.4.4 2 net-firewall/ipsec-tools < 0.6.3 >= 0.6.3 *>= 0.6.2-r1 *>= 0.4-r2 ------------------------------------------------------------------- 2 affected packages on all of their supported architectures. ------------------------------------------------------------------- Description =========== The Oulu University Secure Programming Group (OUSPG) discovered that various ISAKMP implementations, including Openswan and racoon (included in the IPsec-Tools package), behave in an anomalous way when they receive and handle ISAKMP Phase 1 packets with invalid or abnormal contents. Workaround ========== Avoid using "aggressive mode" in ISAKMP Phase 1, which exchanges information between the sides before there is a secure channel. Resolution ========== All Openswan users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/openswan-2.4.4" All IPsec-Tools users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose net-firewall/ipsec-tools References ========== [ 1 ] CVE-2005-3671 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3671 [ 2 ] CVE-2005-3732 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3732 [ 3 ] Original Advisory http://www.ee.oulu.fi/research/ouspg/protos/testing/c09/isakmp/ Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-200512-04.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at http://bugs.gentoo.org. License ======= Copyright 2005 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.0 . TITLE: Nortel Switched Firewall ISAKMP IKE Message Processing Denial of Service SECUNIA ADVISORY ID: SA17608 VERIFY ADVISORY: http://secunia.com/advisories/17608/ CRITICAL: Moderately critical IMPACT: DoS WHERE: >From remote OPERATING SYSTEM: Nortel Switched Firewall 5000 Series http://secunia.com/product/6126/ Nortel Switched Firewall 5100 Series http://secunia.com/product/6125/ Nortel Switched Firewall 6000 Series http://secunia.com/product/6124/ DESCRIPTION: A vulnerability has been reported in Nortel Switched Firewall, which potentially can be exploited by malicious people to cause a DoS (Denial of Service). The vulnerability is caused due to unspecified errors in the processing of IKEv1 Phase 1 protocol exchange messages. This may be exploited to cause a DoS via specially crafted IKE packets. The vulnerability is related to: SA17553 SOLUTION: Refer to the original advisory from Nortel Networks for instructions how to apply fixes. ORIGINAL ADVISORY: Nortel Networks: http://www130.nortelnetworks.com/cgi-bin/eserv/cs/main.jsp?cscat=BLTNDETAIL&DocumentOID=367651&RenditionID= NISCC: http://www.niscc.gov.uk/niscc/docs/re-20051114-01014.pdf?lang=en OTHER REFERENCES: SA17553: http://secunia.com/advisories/17553/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . The updated packages have been patched to correct this problem. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3732 _______________________________________________________________________ Updated Packages: Mandriva Linux 10.1: c1f74be6f3c46152881ded66022a3928 10.1/RPMS/ipsec-tools-0.2.5-2.2.101mdk.i586.rpm c8416853386be9e80b5f8ac6de16cf93 10.1/RPMS/libipsec-tools0-0.2.5-2.2.101mdk.i586.rpm 278751ee3fca05321059c67f39f1a0f0 10.1/SRPMS/ipsec-tools-0.2.5-2.2.101mdk.src.rpm Mandriva Linux 10.1/X86_64: 5d3d19d02d0d5a8eb5fcc237768fb07f x86_64/10.1/RPMS/ipsec-tools-0.2.5-2.2.101mdk.x86_64.rpm 464dadc90a736f6312a6c143c12a4cce x86_64/10.1/RPMS/lib64ipsec-tools0-0.2.5-2.2.101mdk.x86_64.rpm 278751ee3fca05321059c67f39f1a0f0 x86_64/10.1/SRPMS/ipsec-tools-0.2.5-2.2.101mdk.src.rpm Mandriva Linux 10.2: 75b061a206ba4a943904d384e489036c 10.2/RPMS/ipsec-tools-0.5-4.2.102mdk.i586.rpm 3c17715ce5bd1e63347e844bca518fa3 10.2/RPMS/libipsec0-0.5-4.2.102mdk.i586.rpm c221e9fbca14cc956df812605aa67b96 10.2/RPMS/libipsec0-devel-0.5-4.2.102mdk.i586.rpm 313ae7a9fd1eceb117515c61f19f0a2a 10.2/SRPMS/ipsec-tools-0.5-4.2.102mdk.src.rpm Mandriva Linux 10.2/X86_64: 2de25a175eff7fbb77758993965110a5 x86_64/10.2/RPMS/ipsec-tools-0.5-4.2.102mdk.x86_64.rpm ff5095c574441578b6e6e1c9384bf05c x86_64/10.2/RPMS/lib64ipsec0-0.5-4.2.102mdk.x86_64.rpm db6e3f33dc2326528a4c22e199e2c0fa x86_64/10.2/RPMS/lib64ipsec0-devel-0.5-4.2.102mdk.x86_64.rpm 313ae7a9fd1eceb117515c61f19f0a2a x86_64/10.2/SRPMS/ipsec-tools-0.5-4.2.102mdk.src.rpm Mandriva Linux 2006.0: a3881692a4ee81a3e4759500691ba86d 2006.0/RPMS/ipsec-tools-0.5.2-5.1.20060mdk.i586.rpm 4523963e017054a149cc9c6c46e6fa39 2006.0/RPMS/libipsec0-0.5.2-5.1.20060mdk.i586.rpm 9208a98bc79efce31e8bf08c5a409431 2006.0/RPMS/libipsec0-devel-0.5.2-5.1.20060mdk.i586.rpm 390a8547034610a0ebd6a30f8752c36d 2006.0/SRPMS/ipsec-tools-0.5.2-5.1.20060mdk.src.rpm Mandriva Linux 2006.0/X86_64: 89c02c5eebb80544fb54cf8876183d92 x86_64/2006.0/RPMS/ipsec-tools-0.5.2-5.1.20060mdk.x86_64.rpm 833ab780f0ef3eb86da1c2aa82746c72 x86_64/2006.0/RPMS/lib64ipsec0-0.5.2-5.1.20060mdk.x86_64.rpm d875aeb7f90b36eba89ff2e2b901a3cc x86_64/2006.0/RPMS/lib64ipsec0-devel-0.5.2-5.1.20060mdk.x86_64.rpm 390a8547034610a0ebd6a30f8752c36d x86_64/2006.0/SRPMS/ipsec-tools-0.5.2-5.1.20060mdk.src.rpm Multi Network Firewall 2.0: 3a441d674beb304f607975502cb2f302 mnf/2.0/RPMS/ipsec-tools-0.2.5-0.4.M20mdk.i586.rpm 109a0184382426bd065df6000f64189d mnf/2.0/RPMS/libipsec-tools0-0.2.5-0.4.M20mdk.i586.rpm 96dacbdb35121f2f876d1bb19cb00c24 mnf/2.0/SRPMS/ipsec-tools-0.2.5-0.4.M20mdk.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/security/advisories If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) iD8DBQFD19iemqjQ0CJFipgRAp9rAKC7w5Jflg/c/KBy6kdNDiGF8YbgWQCeIbM4 LUncx0ejSC2hQ5/zFlDZKjg= =qhPu -----END PGP SIGNATURE----- . =========================================================== Ubuntu Security Notice USN-221-1 December 01, 2005 ipsec-tools vulnerability CVE-2005-3732 =========================================================== A security issue affects the following Ubuntu releases: Ubuntu 4.10 (Warty Warthog) Ubuntu 5.04 (Hoary Hedgehog) Ubuntu 5.10 (Breezy Badger) The following packages are affected: racoon The problem can be corrected by upgrading the affected package to version 0.3.3-1ubuntu0.2 (for Ubuntu 4.10), 1:0.5-5ubuntu0.1 (for Ubuntu 5.04), or 1:0.6-1ubuntu1.1 (for Ubuntu 5.10). In general, a standard system upgrade is sufficient to effect the necessary changes. When the daemon is configured to use aggressive mode, then it did not check whether the peer sent all required payloads during the IKE negotiation phase. A malicious IPsec peer could exploit this to crash the racoon daemon. Please be aware that racoon is not officially supported by Ubuntu, the package is in the 'universe' component of the archive. Updated packages for Ubuntu 4.10: Source archives: http://security.ubuntu.com/ubuntu/pool/main/i/ipsec-tools/ipsec-tools_0.3.3-1ubuntu0.2.diff.gz Size/MD5: 191462 3f68d0eb625f920ef3ab5e4e1a2b942f http://security.ubuntu.com/ubuntu/pool/main/i/ipsec-tools/ipsec-tools_0.3.3-1ubuntu0.2.dsc Size/MD5: 705 8c92ea1c2b68e7e335892c10020bafc2 http://security.ubuntu.com/ubuntu/pool/main/i/ipsec-tools/ipsec-tools_0.3.3.orig.tar.gz Size/MD5: 864122 b141da8ae299c8fdc53e536f6bbc3ad0 amd64 architecture (Athlon64, Opteron, EM64T Xeon) http://security.ubuntu.com/ubuntu/pool/main/i/ipsec-tools/ipsec-tools_0.3.3-1ubuntu0.2_amd64.deb Size/MD5: 106260 491ea714d329c5b0d6b8283c7579140f http://security.ubuntu.com/ubuntu/pool/universe/i/ipsec-tools/racoon_0.3.3-1ubuntu0.2_amd64.deb Size/MD5: 201510 7c3c1d31969a6924bfe0afbf6f56b468 i386 architecture (x86 compatible Intel/AMD) http://security.ubuntu.com/ubuntu/pool/main/i/ipsec-tools/ipsec-tools_0.3.3-1ubuntu0.2_i386.deb Size/MD5: 101224 5e35a5bfca069cf88d0d349ad86b3cf8 http://security.ubuntu.com/ubuntu/pool/universe/i/ipsec-tools/racoon_0.3.3-1ubuntu0.2_i386.deb Size/MD5: 186400 0627a043d0f0ad1e05830d57c35666f2 powerpc architecture (Apple Macintosh G3/G4/G5) http://security.ubuntu.com/ubuntu/pool/main/i/ipsec-tools/ipsec-tools_0.3.3-1ubuntu0.2_powerpc.deb Size/MD5: 108966 67f208c020df5f1194ab71a0569004f2 http://security.ubuntu.com/ubuntu/pool/universe/i/ipsec-tools/racoon_0.3.3-1ubuntu0.2_powerpc.deb Size/MD5: 196078 2acd7c40b8a56db688fc8ac8484272da Updated packages for Ubuntu 5.04: Source archives: http://security.ubuntu.com/ubuntu/pool/main/i/ipsec-tools/ipsec-tools_0.5-5ubuntu0.1.diff.gz Size/MD5: 41200 47ee31ab5776589dd049a90f0437865b http://security.ubuntu.com/ubuntu/pool/main/i/ipsec-tools/ipsec-tools_0.5-5ubuntu0.1.dsc Size/MD5: 660 cad8e0faad2316aa0a65e28880548f58 http://security.ubuntu.com/ubuntu/pool/main/i/ipsec-tools/ipsec-tools_0.5.orig.tar.gz Size/MD5: 883484 57de611b23eb141173698478e9b64474 amd64 architecture (Athlon64, Opteron, EM64T Xeon) http://security.ubuntu.com/ubuntu/pool/main/i/ipsec-tools/ipsec-tools_0.5-5ubuntu0.1_amd64.deb Size/MD5: 80430 47b366f44e0c8fb49ea43500161a6419 http://security.ubuntu.com/ubuntu/pool/universe/i/ipsec-tools/racoon_0.5-5ubuntu0.1_amd64.deb Size/MD5: 301450 9fd3f818fc41641ed0e691f69b23c441 i386 architecture (x86 compatible Intel/AMD) http://security.ubuntu.com/ubuntu/pool/main/i/ipsec-tools/ipsec-tools_0.5-5ubuntu0.1_i386.deb Size/MD5: 75606 390fe7eb94e2e519bef1a0df6b6d46b5 http://security.ubuntu.com/ubuntu/pool/universe/i/ipsec-tools/racoon_0.5-5ubuntu0.1_i386.deb Size/MD5: 276974 baef582ea75ecaf240298d2917b79fac powerpc architecture (Apple Macintosh G3/G4/G5) http://security.ubuntu.com/ubuntu/pool/main/i/ipsec-tools/ipsec-tools_0.5-5ubuntu0.1_powerpc.deb Size/MD5: 83030 7880cae89438386a5b9f676760eff1be http://security.ubuntu.com/ubuntu/pool/universe/i/ipsec-tools/racoon_0.5-5ubuntu0.1_powerpc.deb Size/MD5: 296838 f417446dce53652608242e1798663622 Updated packages for Ubuntu 5.10: Source archives: http://security.ubuntu.com/ubuntu/pool/main/i/ipsec-tools/ipsec-tools_0.6-1ubuntu1.1.diff.gz Size/MD5: 49677 79084ce144e4b54267f69876d8104387 http://security.ubuntu.com/ubuntu/pool/main/i/ipsec-tools/ipsec-tools_0.6-1ubuntu1.1.dsc Size/MD5: 685 c22deb12d9a0943e3a66aad1a83c3857 http://security.ubuntu.com/ubuntu/pool/main/i/ipsec-tools/ipsec-tools_0.6.orig.tar.gz Size/MD5: 905983 2cd85d36012b4d2c6947f7c17ad45b3e amd64 architecture (Athlon64, Opteron, EM64T Xeon) http://security.ubuntu.com/ubuntu/pool/main/i/ipsec-tools/ipsec-tools_0.6-1ubuntu1.1_amd64.deb Size/MD5: 85086 e894b1b0168138fdb46d0c55095252bf http://security.ubuntu.com/ubuntu/pool/universe/i/ipsec-tools/racoon_0.6-1ubuntu1.1_amd64.deb Size/MD5: 326258 1e7da4aa300a082cdf8034639de4f0a0 i386 architecture (x86 compatible Intel/AMD) http://security.ubuntu.com/ubuntu/pool/main/i/ipsec-tools/ipsec-tools_0.6-1ubuntu1.1_i386.deb Size/MD5: 78912 b46dd5373458dd5500b2513edc6ceec8 http://security.ubuntu.com/ubuntu/pool/universe/i/ipsec-tools/racoon_0.6-1ubuntu1.1_i386.deb Size/MD5: 298016 5df2e64e0ac064876aa21d29c086f902 powerpc architecture (Apple Macintosh G3/G4/G5) http://security.ubuntu.com/ubuntu/pool/main/i/ipsec-tools/ipsec-tools_0.6-1ubuntu1.1_powerpc.deb Size/MD5: 86902 c7c905f335db1bae382af11fe659d335 http://security.ubuntu.com/ubuntu/pool/universe/i/ipsec-tools/racoon_0.6-1ubuntu1.1_powerpc.deb Size/MD5: 319518 1a7abc7fd9645d47d045f63d9f980528

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

resource management error

CONFIGURATIONS

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Discovery is credited to NISCC, CERT-FI, and the Oulu University Secure Programming Group.

SOURCES

LAST UPDATE DATE

2022-05-29T21:11:57.981000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE