Multiple memory leaks in Ipsec-tools before 0.7.2 allow remote attackers to cause a denial of service (memory consumption) via vectors involving (1) signature verification during user authentication with X.509 certificates, related to the eay_check_x509sign function in src/racoon/crypto_openssl.c; and (2) the NAT-Traversal (aka NAT-T) keepalive implementation, related to src/racoon/nattraversal.c.

The remote Redhat Enterprise Linux 4 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - ipsec-tools: multiple memory leaks fixed in 0.7.2 (CVE-2009-1632)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote OracleVM system is missing necessary patches to address critical security updates :

CVE-2009-1574 racoon/isakmp_frag.c in ipsec-tools before 0.7.2 allows remote attackers to cause a denial of service (crash) via crafted fragmented packets without a payload, which triggers a NULL pointer dereference.

CVE-2009-1632 Multiple memory leaks in Ipsec-tools before 0.7.2 allow remote attackers to cause a denial of service (memory consumption) via vectors involving (1) signature verification during user authentication with X.509 certificates, related to the eay_check_x509sign function in src/racoon/crypto_openssl.c  and (2) the NAT-Traversal (aka NAT-T) keepalive implementation, related to src/racoon/nattraversal.c.

CVE-2008-3651 Memory leak in racoon/proposal.c in the racoon daemon in ipsec-tools before 0.7.1 allows remote authenticated users to cause a denial of service (memory consumption) via invalid proposals.

CVE-2008-3652 src/racoon/handler.c in racoon in ipsec-tools does not remove an 'orphaned ph1' (phase 1) handle when it has been initiated remotely, which allows remote attackers to cause a denial of service (resource consumption).

  - fix nul dereference in frag code and some memory leaks     (#497990)

  - also do not destroy ports in ph2 (#231604)

  - improved fix for cleanup of IPSEC SAs in SADB (#231604)

  - fix cleanup of IPSEC SAs in SADB (#231604)

  - fix segfault in timer (#378551)

  - handle new interfaces immediately (#247301)

  - eliminate debug logging overhead when log level is lower     (#248567)

  - use the adminsock_path as specified on the command line     (#247294)

  - link only necessary libraries (#458631)

  - make racoon PIE executable (#210023)

  - fix for DoS through various memory leaks (CVE-2008-3651     #456660, CVE-2008-3652 #458846)

  - use the current kernel headers instead of the private     copy (#446979)

  - Resolves: rhbz#435803 - update pfkeyv2.h with new     #defines

From Red Hat Security Advisory 2009:1036 :

An updated ipsec-tools package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The ipsec-tools package is used in conjunction with the IPsec functionality in the Linux kernel and includes racoon, an IKEv1 keying daemon.

A denial of service flaw was found in the ipsec-tools racoon daemon.
An unauthenticated, remote attacker could trigger a NULL pointer dereference that could cause the racoon daemon to crash.
(CVE-2009-1574)

Multiple memory leak flaws were found in the ipsec-tools racoon daemon. If a remote attacker is able to make multiple connection attempts to the racoon daemon, it was possible to cause the racoon daemon to consume all available memory. (CVE-2009-1632)

Users of ipsec-tools should upgrade to this updated package, which contains backported patches to correct these issues. Users must restart the racoon daemon for this update to take effect.

A denial of service flaw was found in the ipsec-tools racoon daemon.
An unauthenticated, remote attacker could trigger a NULL pointer dereference that could cause the racoon daemon to crash.
(CVE-2009-1574)

Multiple memory leak flaws were found in the ipsec-tools racoon daemon. If a remote attacker is able to make multiple connection attempts to the racoon daemon, it was possible to cause the racoon daemon to consume all available memory. (CVE-2009-1632)

Users must restart the racoon daemon for this update to take effect.

This update of ipsec-tools fixes a crash of racoon in ISAKMP's de-fragmentation code due to a NULL pointer dereference.
(CVE-2009-1574) Additionally multiple memory leaks were fixed that allowed to execute a remote denial of service attack. (CVE-2009-1632)

An updated ipsec-tools package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The ipsec-tools package is used in conjunction with the IPsec functionality in the Linux kernel and includes racoon, an IKEv1 keying daemon.

A denial of service flaw was found in the ipsec-tools racoon daemon.
An unauthenticated, remote attacker could trigger a NULL pointer dereference that could cause the racoon daemon to crash.
(CVE-2009-1574)

Multiple memory leak flaws were found in the ipsec-tools racoon daemon. If a remote attacker is able to make multiple connection attempts to the racoon daemon, it was possible to cause the racoon daemon to consume all available memory. (CVE-2009-1632)

Users of ipsec-tools should upgrade to this updated package, which contains backported patches to correct these issues. Users must restart the racoon daemon for this update to take effect.

The remote host is running a version of Mac OS X 10.6 that is older than version 10.6.2.  Mac OS X 10.6.2 contains security fixes for the following products : 

  - Adaptive Firewall

  - Apache

  - Apache Protable Runtime

  - Certificate Assistant

  - CoreMedia

  - CUPS

  - DoveCot

  - fetchmail

  - file

  - FTP Server

  - Help Viewer

  - ImageIO

  - IOKit

  - IPSec

  - Kernel

  - Launch Services

  - libsecurity

  - libxml

 Login Window

  - OpenLDAP

  - QuickDraw Manager

QuickTime

  - Screen Sharing

  - Subversion

The remote host is running a version of Mac OS X 10.6.x that is prior to 10.6.2.

Mac OS X 10.6.2 contains security fixes for the following products :

  - Adaptive Firewall
  - Apache
  - Apache Portable Runtime
  - Certificate Assistant
  - CoreMedia
  - CUPS
  - Dovecot
  - fetchmail
  - file
  - FTP Server
  - Help Viewer
  - ImageIO
  - IOKit
  - IPSec
  - Kernel
  - Launch Services
  - libsecurity
  - libxml
  - Login Window
  - OpenLDAP
  - QuickDraw Manager
  - QuickTime
  - Screen Sharing
  - Subversion

The remote host is running a version of Mac OS X 10.5 that does not have Security Update 2009-006 applied.

This security update contains fixes for the following products :

  - AFP Client
  - Adaptive Firewall
  - Apache
  - Apache Portable Runtime
  - ATS
  - Certificate Assistant
  - CoreGraphics
  - CUPS
  - Dictionary
  - DirectoryService
  - Disk Images
  - Event Monitor
  - fetchmail
  - FTP Server
  - Help Viewer
  - International Components for Unicode
  - IOKit
  - IPSec
  - libsecurity
  - libxml
  - OpenLDAP
  - OpenSSH
  - PHP
  - QuickDraw Manager
  - QuickLook
  - FreeRADIUS
  - Screen Sharing
  - Spotlight
  - Subversion

This update of ipsec-tools fixes multiple memory leaks were fixed that allowed to execute a remote denial of service attack. (CVE-2009-1632)

It was discovered that ipsec-tools did not properly handle certain fragmented packets. A remote attacker could send specially crafted packets to the server and cause a denial of service. (CVE-2009-1574)

It was discovered that ipsec-tools did not properly handle memory usage when verifying certificate signatures or processing nat-traversal keep-alive messages. A remote attacker could send specially crafted packets to the server and exhaust available memory, leading to a denial of service. (CVE-2009-1632).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200905-03 (IPSec Tools: Denial of Service)

    The following vulnerabilities have been found in the racoon daemon as     shipped with IPSec Tools:
    Neil Kettle reported that     racoon/isakmp_frag.c is prone to a NULL pointer dereference     (CVE-2009-1574).
    Multiple memory leaks exist in (1) the     eay_check_x509sign() function in racoon/crypto_openssl.c and (2)     racoon/nattraversal.c (CVE-2009-1632).
  Impact :

    A remote attacker could send specially crafted fragmented ISAKMP     packets without a payload or exploit vectors related to X.509     certificate authentication and NAT traversal, possibly resulting in a     crash of the racoon daemon.
  Workaround :

    There is no known workaround at this time.

Several remote vulnerabilities have been discovered in racoon, the Internet Key Exchange daemon of ipsec-tools. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-1574     Neil Kettle discovered a NULL pointer dereference on     crafted fragmented packets that contain no payload. This     results in the daemon crashing which can be used for     denial of service attacks.

  - CVE-2009-1632     Various memory leaks in the X.509 certificate     authentication handling and the NAT-Traversal keepalive     implementation can result in memory exhaustion and thus     denial of service.

The remote Redhat Enterprise Linux 5 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2009:1036 advisory.

    The ipsec-tools package is used in conjunction with the IPsec functionality     in the Linux kernel and includes racoon, an IKEv1 keying daemon.

    A denial of service flaw was found in the ipsec-tools racoon daemon. An     unauthenticated, remote attacker could trigger a NULL pointer dereference     that could cause the racoon daemon to crash. (CVE-2009-1574)

    Multiple memory leak flaws were found in the ipsec-tools racoon daemon. If     a remote attacker is able to make multiple connection attempts to the     racoon daemon, it was possible to cause the racoon daemon to consume all     available memory. (CVE-2009-1632)

    Users of ipsec-tools should upgrade to this updated package, which contains     backported patches to correct these issues. Users must restart the racoon     daemon for this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
200034	RHEL 4 : ipsec-tools (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
79457	OracleVM 2.1 : ipsec-tools (OVMSA-2009-0010)	Nessus	OracleVM Local Security Checks	high
67859	Oracle Linux 5 : ipsec-tools (ELSA-2009-1036)	Nessus	Oracle Linux Local Security Checks	medium
60585	Scientific Linux Security Update : ipsec-tools on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
51759	SuSE 10 Security Update : Novell ipsec tools (ZYPP Patch Number 6306)	Nessus	SuSE Local Security Checks	medium
43749	CentOS 5 : ipsec-tools (CESA-2009:1036)	Nessus	CentOS Local Security Checks	medium
800795	Mac OS X 10.6 < 10.6.2 Multiple Vulnerabilities	Log Correlation Engine	Operating System Detection	high
5227	Mac OS X 10.6 < 10.6.2 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical
42434	Mac OS X 10.6.x < 10.6.2 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
42433	Mac OS X Multiple Vulnerabilities (Security Update 2009-006)	Nessus	MacOS X Local Security Checks	critical
42025	openSUSE 10 Security Update : novell-ipsec-tools (novell-ipsec-tools-6307)	Nessus	SuSE Local Security Checks	medium
41523	SuSE 10 Security Update : ipsec-tools (ZYPP Patch Number 6301)	Nessus	SuSE Local Security Checks	medium
41440	SuSE 11 Security Update : Novell ipsec tools (SAT Patch Number 1006)	Nessus	SuSE Local Security Checks	medium
41403	SuSE 11 Security Update : ipsec-tools (SAT Patch Number 998)	Nessus	SuSE Local Security Checks	medium
41305	SuSE9 Security Update : ipsec-tools (YOU Patch Number 12438)	Nessus	SuSE Local Security Checks	medium
40283	openSUSE Security Update : novell-ipsec-tools (novell-ipsec-tools-1007)	Nessus	SuSE Local Security Checks	medium
40233	openSUSE Security Update : ipsec-tools (ipsec-tools-996)	Nessus	SuSE Local Security Checks	medium
40081	openSUSE Security Update : novell-ipsec-tools (novell-ipsec-tools-1007)	Nessus	SuSE Local Security Checks	medium
39993	openSUSE Security Update : ipsec-tools (ipsec-tools-996)	Nessus	SuSE Local Security Checks	medium
39514	openSUSE 10 Security Update : ipsec-tools (ipsec-tools-6302)	Nessus	SuSE Local Security Checks	medium
39353	Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 : ipsec-tools vulnerabilities (USN-785-1)	Nessus	Ubuntu Local Security Checks	medium
38884	GLSA-200905-03 : IPSec Tools: Denial of Service	Nessus	Gentoo Local Security Checks	medium
38861	Debian DSA-1804-1 : ipsec-tools - NULL pointer dereference, memory leaks	Nessus	Debian Local Security Checks	medium
38819	RHEL 5 : ipsec-tools (RHSA-2009:1036)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2009-1632

critical

Tenable Plugins

critical

high

medium

medium

medium

medium

high

critical

critical

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

critical