src/racoon/handler.c in racoon in ipsec-tools does not remove an "orphaned ph1" (phase 1) handle when it has been initiated remotely, which allows remote attackers to cause a denial of service (resource consumption).

The remote OracleVM system is missing necessary patches to address critical security updates :

CVE-2009-1574 racoon/isakmp_frag.c in ipsec-tools before 0.7.2 allows remote attackers to cause a denial of service (crash) via crafted fragmented packets without a payload, which triggers a NULL pointer dereference.

CVE-2009-1632 Multiple memory leaks in Ipsec-tools before 0.7.2 allow remote attackers to cause a denial of service (memory consumption) via vectors involving (1) signature verification during user authentication with X.509 certificates, related to the eay_check_x509sign function in src/racoon/crypto_openssl.c  and (2) the NAT-Traversal (aka NAT-T) keepalive implementation, related to src/racoon/nattraversal.c.

CVE-2008-3651 Memory leak in racoon/proposal.c in the racoon daemon in ipsec-tools before 0.7.1 allows remote authenticated users to cause a denial of service (memory consumption) via invalid proposals.

CVE-2008-3652 src/racoon/handler.c in racoon in ipsec-tools does not remove an 'orphaned ph1' (phase 1) handle when it has been initiated remotely, which allows remote attackers to cause a denial of service (resource consumption).

  - fix nul dereference in frag code and some memory leaks     (#497990)

  - also do not destroy ports in ph2 (#231604)

  - improved fix for cleanup of IPSEC SAs in SADB (#231604)

  - fix cleanup of IPSEC SAs in SADB (#231604)

  - fix segfault in timer (#378551)

  - handle new interfaces immediately (#247301)

  - eliminate debug logging overhead when log level is lower     (#248567)

  - use the adminsock_path as specified on the command line     (#247294)

  - link only necessary libraries (#458631)

  - make racoon PIE executable (#210023)

  - fix for DoS through various memory leaks (CVE-2008-3651     #456660, CVE-2008-3652 #458846)

  - use the current kernel headers instead of the private     copy (#446979)

  - Resolves: rhbz#435803 - update pfkeyv2.h with new     #defines

The remote Oracle Linux 5 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2008-0849 advisory.

    [0.6.5-9.3]
    - fix for DoS through various memory leaks (CVE-2008-3651 #456660,       CVE-2008-3652 #458846)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Two denial of service flaws were found in the ipsec-tools racoon daemon. It was possible for a remote attacker to cause the racoon daemon to consume all available memory. (CVE-2008-3651, CVE-2008-3652)

Remote attackers could exploit memory leaks in the 'racoon' daemon to crash it. (CVE-2008-3651 / CVE-2008-3652)

Remote attackers could exploit memory leaks in the 'racoon' daemon to crash it. (CVE-2008-3651, CVE-2008-3652)

Remote attackers could exploit memory leaks in the 'racoon' daemon to crash it (CVE-2008-3651, CVE-2008-3652)

The remote host is running a version of Mac OS X 10.5.x that is prior to 10.5.7. 

Mac OS X 10.5.7 contains security fixes for the following products :

  - Apache
  - ATS
  - BIND
  - CFNetwork
  - CoreGraphics
  - Cscope
  - CUPS
  - Disk Images
  - enscript
  - Flash Player plug-in
  - Help Viewer
  - iChat
  - International Components for Unicode
  - IPSec
  - Kerberos
  - Kernel
  - Launch Services
  - libxml
  - Net-SNMP
  - Network Time
  - Networking
  - OpenSSL
  - PHP
  - QuickDraw Manager
  - ruby
  - Safari
  - Spotlight
  - system_cmds
  - telnet
  - Terminal
  - WebKit
  - X11

The remote host is running a version of Mac OS X 10.4 that does not have Security Update 2009-002 applied.

This security update contains fixes for the following products :

  - Apache
  - ATS
  - BIND
  - CoreGraphics
  - Cscope
  - CUPS
  - Disk Images
  - enscript
  - Flash Player plug-in
  - Help Viewer
  - IPSec
  - Kerberos
  - Launch Services
  - libxml
  - Net-SNMP
  - Network Time
  - OpenSSL
  - QuickDraw Manager
  - Spotlight
  - system_cmds
  - telnet
  - Terminal
  - X11

Two denial of service vulnerabilities were discovered in the ipsec-tools racoon daemon, which could allow a remote attacker to cause it to consume all available memory (CVE-2008-3651, CVE-2008-3652).

The updated packages have been patched to prevent these issues.

SecurityFocus reports :

IPsec-Tools is affected by multiple remote denial-of-service vulnerabilities because the software fails to properly handle certain network packets.

A successful attack allows a remote attacker to crash the software, denying further service to legitimate users.

The remote host is affected by the vulnerability described in GLSA-200812-03 (IPsec-Tools: racoon Denial of Service)

    Two Denial of Service vulnerabilities have been reported in racoon:
    The vendor reported a memory leak in racoon/proposal.c that can be     triggered via invalid proposals (CVE-2008-3651).
    Krzysztof Piotr Oledzk reported that src/racoon/handler.c does not     remove an 'orphaned ph1' (phase 1) handle when it has been initiated     remotely (CVE-2008-3652).
  Impact :

    An attacker could exploit these vulnerabilities to cause a Denial of     Service.
  Workaround :

    There is no known workaround at this time.

The update fixes memory leaks potentially leading to DoS (CVE-2008-3651 CVE-2008-3652). It also fixes problems with DPD and NAT-T support. This has been in rawhide for a while, with no bad reports. It improves remote-access client connection to Cisco ASA.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The update fixes memory leaks potentially leading to DoS (CVE-2008-3651 CVE-2008-3652). It also fixes problems with DPD and NAT-T support.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that there were multiple ways to leak memory during the IKE negotiation when handling certain packets. If a remote attacker sent repeated malicious requests, the 'racoon' key exchange server could allocate large amounts of memory, possibly leading to a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An updated ipsec-tools package that fixes two security issues is now available for Red Hat Enterprise Linux 3, 4, and 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The ipsec-tools package is used in conjunction with the IPsec functionality in the Linux kernel and includes racoon, an IKEv1 keying daemon.

Two denial of service flaws were found in the ipsec-tools racoon daemon. It was possible for a remote attacker to cause the racoon daemon to consume all available memory. (CVE-2008-3651, CVE-2008-3652)

Users of ipsec-tools should upgrade to this updated package, which contains backported patches that resolve these issues.

The remote host is running a version of Mac OS X 10.5 that is older than version 10.5.7.  Mac OS X 10.5.7 contains security fixes for the following products : 

- Apache
- ATS
- BIND
- CFNetwork
- CoreGraphics
-Cscope
- CUPS
- Disk Images
- enscript
- Flash player
- Help Viewer
- iChat
- Internation Components for Unicode
- IPSec
- Kerberos
- Kernel
- Launch Services
- libxml
- Net-SNMP
- Network Time
- Networking
- OpenSSL
- PHP
- QuickDraw Manager
- ruby
- Safari
- Spotlight
- system_cmds
- telnet
- WebKit
- X11
- Terminal

ID	Name	Product	Family	Severity
79457	OracleVM 2.1 : ipsec-tools (OVMSA-2009-0010)	Nessus	OracleVM Local Security Checks	high
67741	Oracle Linux 5 : ipsec-tools (ELSA-2008-0849)	Nessus	Oracle Linux Local Security Checks	high
60468	Scientific Linux Security Update : ipsec-tools on SL3.x, SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
51758	SuSE 10 Security Update : novell-ipsec (ZYPP Patch Number 5888)	Nessus	SuSE Local Security Checks	high
41246	SuSE9 Security Update : ipsec-tools (YOU Patch Number 12259)	Nessus	SuSE Local Security Checks	high
40080	openSUSE Security Update : novell-ipsec-tools (novell-ipsec-tools-389)	Nessus	SuSE Local Security Checks	high
39992	openSUSE Security Update : ipsec-tools (ipsec-tools-223)	Nessus	SuSE Local Security Checks	high
38744	Mac OS X 10.5.x < 10.5.7 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
38743	Mac OS X Multiple Vulnerabilities (Security Update 2009-002)	Nessus	MacOS X Local Security Checks	critical
37703	Mandriva Linux Security Advisory : ipsec-tools (MDVSA-2008:181)	Nessus	Mandriva Local Security Checks	high
35680	openSUSE 10 Security Update : novell-ipsec-tools (novell-ipsec-tools-5887)	Nessus	SuSE Local Security Checks	high
35442	FreeBSD : ipset-tools -- Denial of Service Vulnerabilities (abcacb5a-e7f1-11dd-afcd-00e0815b8da8)	Nessus	FreeBSD Local Security Checks	high
35020	GLSA-200812-03 : IPsec-Tools: racoon Denial of Service	Nessus	Gentoo Local Security Checks	high
34740	SuSE 10 Security Update : ipsec-tools (ZYPP Patch Number 5638)	Nessus	SuSE Local Security Checks	high
34739	openSUSE 10 Security Update : ipsec-tools (ipsec-tools-5630)	Nessus	SuSE Local Security Checks	high
34711	Fedora 8 : ipsec-tools-0.7.1-5.fc8 (2008-9016)	Nessus	Fedora Local Security Checks	high
34710	Fedora 9 : ipsec-tools-0.7.1-5.fc9 (2008-9007)	Nessus	Fedora Local Security Checks	high
34116	Ubuntu 6.06 LTS / 7.04 / 7.10 / 8.04 LTS : ipsec-tools vulnerabilities (USN-641-1)	Nessus	Ubuntu Local Security Checks	high
34054	RHEL 3 / 4 / 5 : ipsec-tools (RHSA-2008:0849)	Nessus	Red Hat Local Security Checks	high
34052	CentOS 3 / 4 / 5 : ipsec-tools (CESA-2008:0849)	Nessus	CentOS Local Security Checks	high
5023	Mac OS X 10.5 < 10.5.7 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical
800792	Mac OS X 10.5 < 10.5.7 Multiple Vulnerabilities	Log Correlation Engine	Operating System Detection	high

Detections

Analytics

CVE-2008-3652

high

Tenable Plugins

high

high

high

high

high

high

high

critical

critical

high

high

high

high

high

high

high

high

high

high

high

critical

high