|
|
Info |
Last Modified |
| 7 months ago |
|
|
|
|
Description |
KAME contains a flaw related to the sin6_scope_id values in kame/sys/netkey/key.c that may allow an attacker to incorrectly match IP addresses. In the key_cmpspidx_withmask function, sin6_scope_id variables are compared only when both variables are non-zero. However, an address of ::/0 would not match fe80::1%ne0, for example, and this could potentially lead to spoofing. No further details have been provided.
|
|
Classification |
Location:
Remote/Network Access Required
Attack Type:
Input Manipulation
Impact:
Loss of Integrity
Exploit:
Exploit Available
Disclosure:
OSVDB Verified
|
|
Solution |
Upgrade to version 1.1429 or higher, as it has been reported to fix this vulnerability. It is also possible to correct the flaw by applying the vendor-supplied patch.
|
|
Products |
|
KAME
 |
1.1428 |
|
|
|
|
Credit |
Unknown or Incomplete
|
|
BlogsProvided by Technorati
|
None found at this time
|
|
|
