Avaya VSU/CSU Products ISAKMP IKE Traffic Denial of Service Vulnerability

Bugtraq ID:	16613
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Feb 13 2006 12:00AM
Updated:	Feb 14 2006 05:13PM
Credit:	This issue was reported by the vendor.
Vulnerable:	Avaya VSU 7500 3.2.40 Avaya VSU 2000 3.2.40 Avaya VSU 10000 3.2.40 Avaya VSU 100 3.2.40 Avaya CSU 5000 3.2.40
Not Vulnerable:	Avaya VSU 7500 3.2.41 Avaya VSU 2000 3.2.41 Avaya VSU 10000 3.2.41 Avaya VSU 100 3.2.41 Avaya CSU 5000 3.2.41

Avaya VSU/CSU Products ISAKMP IKE Traffic Denial of Service Vulnerability

Avaya VSU/CSU Products are prone to a denial of service when handling malformed IKE traffic.

It is conjectured that the issue can occur if a packet with a malformed payload is sent during an IKE exchange, causing the daemon to crash.

Avaya VSU/CSU Products ISAKMP IKE Traffic Denial of Service Vulnerability

This issue can be reproduced using the PROTOS ISAKMP Test Suite.

Avaya VSU/CSU Products ISAKMP IKE Traffic Denial of Service Vulnerability

Solution:
The vendor has released updates for Avaya products to address this issue. Please contact the vendor for further information.

Avaya VSU/CSU Products ISAKMP IKE Traffic Denial of Service Vulnerability

References:

• Multiple Vulnerabilities in IKEv1 (US-CERT-VU#226364 NISCC-273756) (Avaya)
  
• Multiple Vulnerability Issues in Implementations of ISAKMP Protocol (NISCC)