Multiple IPSec implementations, including KAME, ipsec-tools, and operating systems that include them contain a flaw that may allow a malicious user to make a successful IPSec connection without proper authorization. The issue is triggered when the attacker possesses any valid and trusted X.509 certificate and the server attempts to use RSA signature authentication. While the server does check the validity of the X.509 certificate, it fails to check the RSA signature of that certificate. It is possible that the flaw may allow unauthorized access, resulting in a loss of confidentiality.

The KAME IKE daemon Racoon and its Linux 2.6 port in ipsec-tools fail to verify the RSA signature during phase one of an IPSec connection, using either main or aggressive mode. The X.509 certificate of the client is verified, but the certificate is not used to verify the client's signature. This could allow remote attackers to establish unauthorized IP connections or conduct man-in-the-middle attacks, provided that they possess a valid, trusted X.509 certificate. As you can see, the vulnerable code in the eay_rsa_verify() function of crypto_openssl.c reads as follows:

evp = d2i_PUBKEY(NULL, &bp, pubkey->l);
if (evp == NULL)
return 0;

d2i_PUBKEY always returns NULL, and so the function always exits with the returncode 0 (success). There is no signature verification.

Upgrade to version 1.84 of KAME or a recent CVS tree, version 1.62 of NetBSD, version 4.9-CURRENT of FreeBSD, version 0.2.5 of ipsec-tools, or higher, as these have been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

• Bugtraq ID: 10072
• Secunia Advisory ID: 11328 14178
• ISS X-Force ID: 15783
• CVE ID: 2004-0155 (see also: NVD)
• CERT VU: 552398
• Other Advisory URL: ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.10/SCOSA-2005.10.txt http://ipsec-tools.sourceforge.net/x509sig.html
• Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2004-04/0062.html
• Vendor Specific Advisory URL: http://www.gentoo.org/security/en/glsa/glsa-200406-17.xml
  http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2004:027
  http://www.net-security.org/advisory.php?id=3300
  http://www.redhat.com/support/errata/RHSA-2004-165.html
• Vendor URL: http://www.kame.net/racoon/
• CIAC Advisory: o-138

• Ralf Spenneberg - ralfspenneberg.net -
• Michal Ludvig - michallogix.cz - IPSec-Tools
• Hans Hacker -