The Internet Key Exchange version 1 (IKEv1) implementation (isakmp_agg.c) in racoon in ipsec-tools before 0.6.3, when running in aggressive mode, allows remote attackers to cause a denial of service (null dereference and crash) via crafted IKE packets, as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1.

The Internet Key Exchange version 1 (IKEv1) implementation in racoon from ipsec-tools, IPsec tools for Linux, try to dereference a NULL pointer under certain conditions which allows a remote attacker to cause a denial of service.

Updated ipsec-tools packages that fix a bug in racoon are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The ipsec-tools package is used in conjunction with the IPsec functionality in the linux kernel and includes racoon, an IKEv1 keying daemon.

A denial of service flaw was found in the ipsec-tools racoon daemon.
If a victim's machine has racoon configured in a non-recommended insecure manner, it is possible for a remote attacker to crash the racoon daemon. (CVE-2005-3732)

Users of ipsec-tools should upgrade to these updated packages, which contain backported patches, and are not vulnerable to these issues.

The Internet Key Exchange version 1 (IKEv1) implementation (isakmp_agg.c) in ipsec-tools racoon before 0.6.3, when running in aggressive mode, allows remote attackers to cause a denial of service (null dereference and crash) via crafted IKE packets, as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1.

The updated packages have been patched to correct this problem.

The Oulu University Secure Programming Group discovered a remote Denial of Service vulnerability in the racoon daemon. When the daemon is configured to use aggressive mode, then it did not check whether the peer sent all required payloads during the IKE negotiation phase.
A malicious IPsec peer could exploit this to crash the racoon daemon.

Please be aware that racoon is not officially supported by Ubuntu, the package is in the 'universe' component of the archive.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200512-04 (Openswan, IPsec-Tools: Vulnerabilities in ISAKMP Protocol implementation)

    The Oulu University Secure Programming Group (OUSPG) discovered that     various ISAKMP implementations, including Openswan and racoon (included     in the IPsec-Tools package), behave in an anomalous way when they     receive and handle ISAKMP Phase 1 packets with invalid or abnormal     contents.
  Impact :

    A remote attacker could craft specific packets that would result in a     Denial of Service attack, if Openswan and racoon are used in specific,     weak configurations.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
22831	Debian DSA-965-1 : ipsec-tools - null dereference	Nessus	Debian Local Security Checks	critical
21894	CentOS 3 / 4 : ipsec-tools (CESA-2006:0267)	Nessus	CentOS Local Security Checks	critical
21286	RHEL 3 / 4 : ipsec-tools (RHSA-2006:0267)	Nessus	Red Hat Local Security Checks	critical
20809	Mandrake Linux Security Advisory : ipsec-tools (MDKSA-2006:020)	Nessus	Mandriva Local Security Checks	critical
20763	Ubuntu 4.10 / 5.04 / 5.10 : ipsec-tools vulnerability (USN-221-1)	Nessus	Ubuntu Local Security Checks	high
20313	GLSA-200512-04 : Openswan, IPsec-Tools: Vulnerabilities in ISAKMP Protocol implementation	Nessus	Gentoo Local Security Checks	high

Detections

Analytics

CVE-2005-3732

high

Tenable Plugins

critical

critical

critical

critical

high

high