|
|
Info |
Last Modified |
| 5 months ago |
|
|
|
|
Description |
Many IPSec implementations, including KAME, Linux FreeS/WAN, and operating systems that include them contain a flaw that may allow a remote denial of service. The issue is triggered when a very short IPSec packet is sent, and will result in loss of availability for the service, and in some cases will trigger a kernel panic and loss of availability for the platform.
|
|
Classification |
Location:
Local Access Required,
Remote/Network Access Required
Attack Type:
Denial of Service,
Input Manipulation
Impact:
Loss of Availability
Exploit:
Exploit Available
Disclosure:
OSVDB Verified
|
|
Technical |
While processing an IPSec datagram, many IPSec implementations do not properly calculate the length of the authentication data field for very small datagrams. This vulnerability report is based only on ESP IPSec packets for IPv4, but the reporting researcher suggests that the same issues are likely to also be found for AH and/or for IPv6 packets.
IPSec's ESP (Encapsulating Security Payload) protocol's authentication is based in part on a Security Association (SA). The size of the authentication data field will depend on the authentication algorithm used by the SA, but is usually 12 bytes or more. When an ESP packet arrives, the IPSec implementation looks up the relevant SA and attempts to verify the authentication data. The vulnerable IPSec implementations either fail to check for the presence of the auth data, or check incorrectly. Spoofing very short ESP packets with only 8 bytes of IP payload can cause the Integrity Check Value to be calculated for an overly large range of memory, resulting in an unsigned integer overflow. This can cause a kernel panic.
|
|
Solution |
Upgrade to NetBSD version 1.5.4, FreeBSD version 4.7, KAME version 1.1 post-2002/08/21, FreeS/WAN version 1.99, or higher, as this has been reported to fix this vulnerability. It is also possible to correct the flaw by applying the patch from the relevant vendor.
|
|
Products |
|
FreeBSD
 |
3.x |
4.3-RELEASE |
4.4-RELEASE |
4.5-RELEASE |
4.6-RELEASE |
4.2-RELEASE |
4.1-RELEASE |
4.0-RELEASE |
|
NetBSD
|
1.5 |
1.5.1 |
1.5.2 |
1.5.3 |
|
KAME
|
1.1 prior to 2002/08/21 |
|
FreeS/WAN
|
1.98 |
1.98b |
1.97 |
1.96 |
1.95 |
1.94 |
1.93 |
1.92 |
1.91 |
1.9 |
1.8 |
1.7 |
1.6 |
1.5 |
|
|
|
|
|
|
Credit |
- Todd Sabin - tsabin
 razor.bindview.com - Bindview RAZOR
|
|
BlogsProvided by Technorati
|
None found at this time
|
|
|
