tinc VPN Replay Attack Vulnerability
BID:3837
Info
tinc VPN Replay Attack Vulnerability
| Bugtraq ID: | 3837 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 29 2001 12:00AM |
| Updated: | Dec 29 2001 12:00AM |
| Credit: | Published by Jerome Etienne <[email protected]> on December 29, 2001. |
| Vulnerable: |
tinc tinc 1.0 pre4 tinc tinc 1.0 pre3 |
| Not Vulnerable: |
tinc tinc 1.0 pre5 |
Discussion
tinc VPN Replay Attack Vulnerability
tinc is a Virtual Private Network (VPN) daemon designed for Linux and Unix based systems. It acts as a tunnel for a network interface, and embeds all communication into a sequence of encrypted UDP packets. This allows private network communication to occur through a larger network. tinc uses blowfish in cipher block chaining (CBC) mode to encrypt packets. The secret key is shared via a PKI-style handshake during the authentication process between two tinc daemons.
An attacker may be able to take advantage of knowledge about the structure of network traffic. If an attacker is aware that two packets will have similar payloads, he may substitute one for the other through a man in the middle attack. Some network communication, such as that using the UDP protocol, may not be able to detect this modification.
In order to exploit this vulnerability, the attacker must be able to modify network traffic. A man in the middle attack may be difficult, as tinc includes support for secure authentication between tinc daemons.
tinc is a Virtual Private Network (VPN) daemon designed for Linux and Unix based systems. It acts as a tunnel for a network interface, and embeds all communication into a sequence of encrypted UDP packets. This allows private network communication to occur through a larger network. tinc uses blowfish in cipher block chaining (CBC) mode to encrypt packets. The secret key is shared via a PKI-style handshake during the authentication process between two tinc daemons.
An attacker may be able to take advantage of knowledge about the structure of network traffic. If an attacker is aware that two packets will have similar payloads, he may substitute one for the other through a man in the middle attack. Some network communication, such as that using the UDP protocol, may not be able to detect this modification.
In order to exploit this vulnerability, the attacker must be able to modify network traffic. A man in the middle attack may be difficult, as tinc includes support for secure authentication between tinc daemons.
Exploit / POC
tinc VPN Replay Attack Vulnerability
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
tinc VPN Replay Attack Vulnerability
Solution:
An updated version has been released:
tinc tinc 1.0 pre4
tinc tinc 1.0 pre3
Solution:
An updated version has been released:
tinc tinc 1.0 pre4
-
tinc tinc-1.0pre5.tar.gz
http://tinc.nl.linux.org/packages/tinc-1.0pre5.tar.gz
tinc tinc 1.0 pre3
-
tinc tinc-1.0pre5.tar.gz
http://tinc.nl.linux.org/packages/tinc-1.0pre5.tar.gz