KAME Racoon "Initial Contact" SA Deletion Vulnerability
BID:9417
Info
KAME Racoon "Initial Contact" SA Deletion Vulnerability
| Bugtraq ID: | 9417 |
| Class: | Access Validation Error |
| CVE: |
CVE-2004-0164 |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 14 2004 12:00AM |
| Updated: | Jul 12 2009 02:06AM |
| Credit: | Discovered by Thomas Walpuski <[email protected]>. |
| Vulnerable: |
SGI ProPack 3.0 SCO Unixware 7.1.4 KAME Racoon |
| Not Vulnerable: | |
Discussion
KAME Racoon "Initial Contact" SA Deletion Vulnerability
It has been reported that it may be possible for attackers to remotely delete security associations (SAs) in hosts running the KAME IKE daemon Racoon.
It has been reported that it may be possible for attackers to remotely delete security associations (SAs) in hosts running the KAME IKE daemon Racoon.
Exploit / POC
KAME Racoon "Initial Contact" SA Deletion Vulnerability
Though no exploit code is available, a detailed description of an attack that exploits this vulnerability is included in the message by Thomas Walpuski <[email protected]>. See the reference section.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Though no exploit code is available, a detailed description of an attack that exploits this vulnerability is included in the message by Thomas Walpuski <[email protected]>. See the reference section.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
KAME Racoon "Initial Contact" SA Deletion Vulnerability
Solution:
SGI has released an advisory (20040506-01-U) with Patch 10075 for SGI ProPack 3 to address this and other issues. Please see the referenced advisory for more information.
NetBSD has released an advisory that includes updates. Fix details may be found in the attached advisory.
Red Hat has released advisory RHSA-2004:165-09 dealing with this and other issues for their enterprise linux distribution. Customers subscribed to the Red Hat Network may apply the appropriate fixes using the Red Hat Update Agent (up2date). Please see referenced advisory for additional information.
The vendor has released a patch to address this issue.
SCO has released advisory SCOSA-2005.10 to address various issues in Racoon affecting UnixWare 7.1.4. Please see the referenced advisory for more information.
KAME Racoon
SGI ProPack 3.0
SCO Unixware 7.1.4
Solution:
SGI has released an advisory (20040506-01-U) with Patch 10075 for SGI ProPack 3 to address this and other issues. Please see the referenced advisory for more information.
NetBSD has released an advisory that includes updates. Fix details may be found in the attached advisory.
Red Hat has released advisory RHSA-2004:165-09 dealing with this and other issues for their enterprise linux distribution. Customers subscribed to the Red Hat Network may apply the appropriate fixes using the Red Hat Update Agent (up2date). Please see referenced advisory for additional information.
The vendor has released a patch to address this issue.
SCO has released advisory SCOSA-2005.10 to address various issues in Racoon affecting UnixWare 7.1.4. Please see the referenced advisory for more information.
KAME Racoon
-
KAME isakmp_inf.patch
http://downloads.securityfocus.com/vulnerabilities/patches/isakmp_inf. patch
SGI ProPack 3.0
-
SGI patch10075.tar.gz
ftp://patches.sgi.com/support/free/security/patches/ProPack/3/
SCO Unixware 7.1.4
-
SCO erg712650.pkg.Z
ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.10/erg712650.pkg.Z
References
KAME Racoon "Initial Contact" SA Deletion Vulnerability
References:
References: