OpenBSD isakmpd Multiple IKE Payload Handling Security Weaknesses
BID:8964
Info
OpenBSD isakmpd Multiple IKE Payload Handling Security Weaknesses
| Bugtraq ID: | 8964 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 03 2003 12:00AM |
| Updated: | Nov 03 2003 12:00AM |
| Credit: | These vulnerabilities were reported by Thomas Walpuski <[email protected]>. |
| Vulnerable: |
OpenBSD OpenBSD 3.4 OpenBSD OpenBSD 3.3 OpenBSD OpenBSD 3.2 OpenBSD OpenBSD 3.1 OpenBSD OpenBSD 3.0 |
| Not Vulnerable: | |
Discussion
OpenBSD isakmpd Multiple IKE Payload Handling Security Weaknesses
OpenBSD's isakmpd daemon is said to be prone to multiple weaknesses when handling various IKE payloads. Specifically, four weaknesses have been discovered in various implementations of the daemon. The problems include:
1) Fails to enforce encrypted Quick Mode messages despite RFC specification.
2) Fails to encrypt Quick Mode payloads if the initiator did not encrypt their initial payload.
3) Does not enforce hash payloads when handling payloads other than those within Quick Mode.
4) Fails to verify the origin of Phase 2 delete messages.
The exploitation of these various conditions could result in the unintential exposure of sensitive session initialization data, as well as the unauthorized deletion of Security Authorities.
As further analysis of these weaknesses are carried out, it is likely that each will be given a separate BID. At this time, this BID will be updated and subsequently retired.
OpenBSD's isakmpd daemon is said to be prone to multiple weaknesses when handling various IKE payloads. Specifically, four weaknesses have been discovered in various implementations of the daemon. The problems include:
1) Fails to enforce encrypted Quick Mode messages despite RFC specification.
2) Fails to encrypt Quick Mode payloads if the initiator did not encrypt their initial payload.
3) Does not enforce hash payloads when handling payloads other than those within Quick Mode.
4) Fails to verify the origin of Phase 2 delete messages.
The exploitation of these various conditions could result in the unintential exposure of sensitive session initialization data, as well as the unauthorized deletion of Security Authorities.
As further analysis of these weaknesses are carried out, it is likely that each will be given a separate BID. At this time, this BID will be updated and subsequently retired.
Exploit / POC
OpenBSD isakmpd Multiple IKE Payload Handling Security Weaknesses
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
References
OpenBSD isakmpd Multiple IKE Payload Handling Security Weaknesses
References:
References:
- multiple payload handling flaws in isakmpd (Thomas Walpuski
- Re: multiple payload handling flaws in isakmpd (Thomas Walpuski