ADTRAN NetVanta Products IKE Traffic Multiple Unspecified Vulnerabilities

Bugtraq ID:	16028
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Nov 23 2005 12:00AM
Updated:	Nov 23 2005 12:00AM
Credit:	Discovery is credited to NISCC, CERT-FI, and the Oulu University Secure Programming Group.
Vulnerable:	ADTRAN ADTRAN OS + ADTRAN NetVanta 3000 Series + ADTRAN NetVanta 4000 Series + ADTRAN NetVanta 5000 Series
Not Vulnerable:	ADTRAN ADTRAN OS 10.0 4.00.E ADTRAN ADTRAN OS 10.0 3.03.E

ADTRAN NetVanta Products IKE Traffic Multiple Unspecified Vulnerabilities

Certain ADTRAN NetVanta products are prone to multiple unspecified vulnerabilities in IKEv1.

Some of the issues could potentially allow for remote code execution and complete compromise of affected devices. This has not been confirmed.

These issues were discovered with the PROTOS ISAKMP Test Suite and are related to handling of malformed IKEv1 traffic.

ADTRAN OS 10.03.03.E is available to address these issues.

ADTRAN NetVanta Products IKE Traffic Multiple Unspecified Vulnerabilities

These issues can be reproduced using the PROTOS ISAKMP Test Suite. It should be noted that the Test Suite may trigger the vulnerabilities but is not designed to exploit the buffer overflow issues to execute arbitrary code.

ADTRAN NetVanta Products IKE Traffic Multiple Unspecified Vulnerabilities

Solution:
The vendor has released an advisory and fixes to address these issues. Please see the referenced advisory for further information on obtaining fixes.

ADTRAN NetVanta Products IKE Traffic Multiple Unspecified Vulnerabilities

References:

• ADTRAN Advisory: ISAKMP Vulnerability (ADTRAN)
  
• ADTRAN Home Page (ADTRAN)
  
• Multiple Vulnerability Issues in Implementations of ISAKMP Protocol (NISCC)