Sun Solaris LibIKE IKE Exchange Denial Of Service Vulnerability

Bugtraq ID:	17902
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	May 09 2006 12:00AM
Updated:	May 10 2006 02:49AM
Credit:	This issue was reported by the vendor.
Vulnerable:	Sun Solaris 9_x86 Sun Solaris 9 Sun Solaris 10.0_x86 Sun Solaris 10
Not Vulnerable:

Sun Solaris LibIKE IKE Exchange Denial Of Service Vulnerability

Sun Solaris is prone to a denial-of-service vulnerability. This issue exists in the 'libike' IKE implementation and may impact the availability of the 'in.iked' daemon.

This issue was discovered using the Oulu University Secure Programming Group (OUSPG) PROTOS ISAKMP Test Suite.

Sun Solaris LibIKE IKE Exchange Denial Of Service Vulnerability

This issue can be reproduced using the Oulu University Secure Programming Group (OUSPG) PROTOS ISAKMP Test Suite.

Sun Solaris LibIKE IKE Exchange Denial Of Service Vulnerability

Solution:
Sun has released patches to address the vulnerability.


Sun Solaris 9_x86

• Sun 114435-10
  http://sunsolve.sun.com/search/pdownload.pl?target=114435-10&method=fs

Sun Solaris 10

• Sun 118371-07
  http://sunsolve.sun.com/search/pdownload.pl?target=118371-07&method=fs

Sun Solaris 9

• Sun 113451-11
  http://sunsolve.sun.com/pub-cgi/pdownload.pl?target=113451-11&method=f

Sun Solaris LibIKE IKE Exchange Denial Of Service Vulnerability

References:

• Sun Alert ID: 102246 (Sun)