The eay_check_x509cert function in KAME Racoon successfully verifies certificates even when OpenSSL validation fails, which could allow remote attackers to bypass authentication.

The remote host is missing Apple's Security Update 2004-09-07. This security update fixes the following components: CoreFoundation, IPSec, Kerberos, libpcap, lukemftpd, NetworkConfig, OpenLDAP, OpenSSH, PPPDialer, rsync, Safari and tcpdump

The remote host is missing Security Update 2004-09-07.  This security update fixes the following components :

  - CoreFoundation
  - IPSec
  - Kerberos
  - libpcap
  - lukemftpd
  - NetworkConfig
  - OpenLDAP
  - OpenSSH
  - PPPDialer
  - rsync
  - Safari
  - tcpdump

These applications contain multiple vulnerabilities that may allow a remote attacker to execute arbitrary code.

The remote host is affected by the vulnerability described in GLSA-200406-17 (IPsec-Tools: authentication bug in racoon)

    The KAME IKE daemon racoon is used to authenticate peers during Phase 1     when using either preshared keys, GSS-API, or RSA signatures. When     using RSA signatures racoon validates the X.509 certificate but not the     RSA signature.
  Impact :

    By sending a valid and trusted X.509 certificate and any private key an     attacker could exploit this vulnerability to perform man-in-the-middle     attacks and initiate unauthorized connections.
  Workaround :

    There is no known workaround at this time. All users are encouraged to     upgrade to the latest available version.

An updated ipsec-tools package that fixes verification of X.509 certificates in racoon is now available.

IPSEC uses strong cryptography to provide both authentication and encryption services.

When configured to use X.509 certificates to authenticate remote hosts, ipsec-tools versions 0.3.3 and earlier will attempt to verify that host certificate, but will not abort the key exchange if verification fails. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0607 to this issue.

Users of ipsec-tools should upgrade to this updated package which contains a backported security patch and is not vulnerable to this issue.

ID	Name	Product	Family	Severity
2274	Mac OS X Multiple Vulnerabilities (Security Update 2004-09-07)	Nessus Network Monitor	Web Clients	medium
14676	Mac OS X Multiple Vulnerabilities (Security Update 2004-09-07)	Nessus	MacOS X Local Security Checks	high
14528	GLSA-200406-17 : IPsec-Tools: authentication bug in racoon	Nessus	Gentoo Local Security Checks	critical
13854	RHEL 3 : ipsec-tools (RHSA-2004:308)	Nessus	Red Hat Local Security Checks	critical
800802	Mac OS X Multiple Vulnerabilities (Security Update 2004-09-07)	Log Correlation Engine	Operating System Detection	high

Detections

Analytics

CVE-2004-0607

critical

Tenable Plugins

medium

high

critical

critical

high