The KAME racoon daemon in ipsec-tools before 0.5 allows remote attackers to cause a denial of service (crash) via malformed ISAKMP packets.

Sebastian Krahmer discovered a Denial of Service vulnerability in the racoon daemon. By sending specially crafted ISAKMP packets, a remote attacker could trigger a buffer overflow which caused racoon to crash.

This update does not introduce any source code changes affecting the ipsec-tools package. It is necessary to update the version number of the package in order to support an update to the 'racoon' package.
Please note that racoon is not officially supported by Ubuntu (it is in the 'universe' component of the archive).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Sebastian Krahmer discovered that the racoon ISAKMP daemon could be crashed with a maliciously crafted UDP packet. No authentication is required in order to perform the attack.

The remote host is missing the patch for the advisory SUSE-SA:2005:020 (ipsec-tools).


Racoon is a ISAKMP key management daemon used in IPsec setups.

Sebastian Krahmer of the SUSE Security Team audited the daemon and found that it handles certain ISAKMP messages in a slightly wrong way, so that remote attackers can crash it via malformed ISAKMP packages.

This update fixes this problem.

This is tracked by the Mitre CVE ID CVE-2005-0398.

A bug was discovered in the way that the racoon daemon handled incoming ISAKMP requests. It is possible that an attacker could crash the racoon daemon by sending a specially crafted ISAKMP packet.

The updated packages have been patched to correct these issues.

The remote IPSEC server seems to have a problem negotiating malformed ISAKMP packets.

An attacker may use this flaw to crash the remote host repeatedly and disable your VPN remotely.

The remote host is affected by the vulnerability described in GLSA-200503-33 (IPsec-Tools: racoon Denial of Service)

    Sebastian Krahmer has reported a potential remote Denial of     Service vulnerability in the ISAKMP header parsing code of racoon.
  Impact :

    An attacker could possibly cause a Denial of Service of racoon     using a specially crafted ISAKMP packet.
  Workaround :

    There is no known workaround at this time.

The remote Redhat Enterprise Linux 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2005:232 advisory.

    The ipsec-tools package is used in conjunction with the IPsec functionality     in the linux kernel. The ipsec-tools package includes:

    - setkey, a program to directly manipulate policies and SAs
    - racoon, an IKEv1 keying daemon

    A bug was found in the way the racoon daemon handled incoming ISAKMP     requests.  It is possible that an attacker could crash the racoon daemon by     sending a specially crafted ISAKMP packet.  The Common Vulnerabilities and     Exposures project (cve.mitre.org) has assigned the name CAN-2005-0398 to     this issue.

    Additionally, the following issues have been fixed:
    - racoon mishandled restarts in the presence of stale administration sockets.
    - on Red Hat Enterprise Linux 4, racoon and setkey did not properly set up       forward policies, which prevented tunnels from working.

    Users of ipsec-tools should upgrade to this updated package, which contains     backported patches, and is not vulnerable to these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
20493	Ubuntu 4.10 : ipsec-tools vulnerability (USN-107-1)	Nessus	Ubuntu Local Security Checks	medium
18903	FreeBSD : racoon -- remote denial-of-service (3b260179-e464-460d-bf9f-d5cda6204020)	Nessus	FreeBSD Local Security Checks	medium
17671	SUSE-SA:2005:020: ipsec-tools	Nessus	SuSE Local Security Checks	medium
17668	Mandrake Linux Security Advisory : ipsec-tools (MDKSA-2005:062)	Nessus	Mandriva Local Security Checks	medium
17655	ipsec-tools KAME racoon Daemon ISAKMP Header Parsing Remote DoS	Nessus	Denial of Service	high
17642	GLSA-200503-33 : IPsec-Tools: racoon Denial of Service	Nessus	Gentoo Local Security Checks	medium
17622	RHEL 4 : ipsec-tools (RHSA-2005:232)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2005-0398

high

Tenable Plugins

medium

medium

medium

medium

high

medium

high