Oracle Linux 5 : ipsec-tools (ELSA-2009-1036)

This script is Copyright (C) 2013 Tenable Network Security, Inc.


Synopsis :

The remote Oracle Linux host is missing a security update.

Description :

From Red Hat Security Advisory 2009:1036 :

An updated ipsec-tools package that fixes multiple security issues is
now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the
Red Hat Security Response Team.

The ipsec-tools package is used in conjunction with the IPsec
functionality in the Linux kernel and includes racoon, an IKEv1 keying
daemon.

A denial of service flaw was found in the ipsec-tools racoon daemon.
An unauthenticated, remote attacker could trigger a NULL pointer
dereference that could cause the racoon daemon to crash.
(CVE-2009-1574)

Multiple memory leak flaws were found in the ipsec-tools racoon
daemon. If a remote attacker is able to make multiple connection
attempts to the racoon daemon, it was possible to cause the racoon
daemon to consume all available memory. (CVE-2009-1632)

Users of ipsec-tools should upgrade to this updated package, which
contains backported patches to correct these issues. Users must
restart the racoon daemon for this update to take effect.

See also :

https://oss.oracle.com/pipermail/el-errata/2009-May/001007.html

Solution :

Update the affected ipsec-tools package.

Risk factor :

Medium / CVSS Base Score : 5.0
(CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS Temporal Score : 4.1
(CVSS2#E:F/RL:OF/RC:C)
Public Exploit Available : true

Family: Oracle Linux Local Security Checks

Nessus Plugin ID: 67859 ()

Bugtraq ID: 34765

CVE ID: CVE-2009-1574
CVE-2009-1632