The Internet Key Exchange version 1 (IKEv1) implementation in Openswan 2 (openswan-2) before 2.4.4, and freeswan in SUSE LINUX 9.1 before 2.04_1.5.4-1.23, allow remote attackers to cause a denial of service via (1) a crafted packet using 3DES with an invalid key length, or (2) unspecified inputs when Aggressive Mode is enabled and the PSK is known, as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1.

This update fixes the following security problem :

  - specially crafted packets could crash pluto as     demonstrated by the PROTOS ISAKMP Test Suite for IKEv1.
    (CVE-2005-3671)

The remote host is affected by the vulnerability described in GLSA-200512-04 (Openswan, IPsec-Tools: Vulnerabilities in ISAKMP Protocol implementation)

    The Oulu University Secure Programming Group (OUSPG) discovered that     various ISAKMP implementations, including Openswan and racoon (included     in the IPsec-Tools package), behave in an anomalous way when they     receive and handle ISAKMP Phase 1 packets with invalid or abnormal     contents.
  Impact :

    A remote attacker could craft specific packets that would result in a     Denial of Service attack, if Openswan and racoon are used in specific,     weak configurations.
  Workaround :

    There is no known workaround at this time.

NISCC has reported two Denial of Service issues in Openswan. The first involves a specially crafted 3DES packet with an invalid key length.

The Openswan project has released version 2.4.4 to fix both issues.

See http://www.openswan.org/ for details.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
41085	SuSE9 Security Update : freeswan (YOU Patch Number 10753)	Nessus	SuSE Local Security Checks	high
20313	GLSA-200512-04 : Openswan, IPsec-Tools: Vulnerabilities in ISAKMP Protocol implementation	Nessus	Gentoo Local Security Checks	high
20243	Fedora Core 4 : openswan-2.4.4-1.0.FC4.1 (2005-1093)	Nessus	Fedora Local Security Checks	high
20242	Fedora Core 3 : openswan-2.4.4-0.FC3.1 (2005-1092)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2005-3671

high

Tenable Plugins

high

high

high

high