Novell BorderManager IPSec/IKE Remote Denial Of Service Vulnerability

Bugtraq ID:	20428
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Oct 10 2006 12:00AM
Updated:	Oct 11 2006 10:24PM
Credit:	This issue was disclosed in the referenced vendor web advisory.
Vulnerable:	Novell BorderManager 3.8
Not Vulnerable:

Novell BorderManager IPSec/IKE Remote Denial Of Service Vulnerability

Novell BorderManager is affected by a remote denial-of-service vulnerability because the application fails to properly handle user-supplied input.

Exploiting this issue will allow an attacker to cause the affected client computer to hang, denying service to legitimate users.

Novell BorderManager version 3.8 is vulnerable.

Novell BorderManager IPSec/IKE Remote Denial Of Service Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Novell BorderManager IPSec/IKE Remote Denial Of Service Vulnerability

Solution:
The vendor has released BorderManager 3.8 POST SP4 Security Patch1 to address this issue; please see the references for details.


Novell BorderManager 3.8

• Novell bmvpnsec1.exe
  http://support.novell.com/servlet/filedownload/sec/ftf/bmvpnsec1.exe

Novell BorderManager IPSec/IKE Remote Denial Of Service Vulnerability

References:

• BorderManager 3.8 POST SP4 Security Patch1 - TID2974551 (last modified 09OCT2006 (Novell)
  
• BorderManager Product Homepage (Novell)