The KAME racoon daemon in ipsec-tools before 0.5 allows remote attackers to cause a denial of service (crash) via malformed ISAKMP packets.

Sebastian Krahmer discovered a Denial of Service vulnerability in the racoon daemon. By sending specially crafted ISAKMP packets, a remote attacker could trigger a buffer overflow which caused racoon to crash.

This update does not introduce any source code changes affecting the ipsec-tools package. It is necessary to update the version number of the package in order to support an update to the 'racoon' package.
Please note that racoon is not officially supported by Ubuntu (it is in the 'universe' component of the archive).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Sebastian Krahmer discovered that the racoon ISAKMP daemon could be crashed with a maliciously crafted UDP packet. No authentication is required in order to perform the attack.

The remote host is missing the patch for the advisory SUSE-SA:2005:020 (ipsec-tools).


Racoon is a ISAKMP key management daemon used in IPsec setups.

Sebastian Krahmer of the SUSE Security Team audited the daemon and found that it handles certain ISAKMP messages in a slightly wrong way, so that remote attackers can crash it via malformed ISAKMP packages.

This update fixes this problem.

This is tracked by the Mitre CVE ID CVE-2005-0398.

A bug was discovered in the way that the racoon daemon handled incoming ISAKMP requests. It is possible that an attacker could crash the racoon daemon by sending a specially crafted ISAKMP packet.

The updated packages have been patched to correct these issues.

The remote IPSEC server seems to have a problem negotiating malformed ISAKMP packets.

An attacker may use this flaw to crash the remote host repeatedly and disable your VPN remotely.

The remote host is affected by the vulnerability described in GLSA-200503-33 (IPsec-Tools: racoon Denial of Service)

    Sebastian Krahmer has reported a potential remote Denial of     Service vulnerability in the ISAKMP header parsing code of racoon.
  Impact :

    An attacker could possibly cause a Denial of Service of racoon     using a specially crafted ISAKMP packet.
  Workaround :

    There is no known workaround at this time.

The remote Redhat Enterprise Linux 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2005:232 advisory.

  - security flaw (CVE-2005-0398)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
20493	Ubuntu 4.10 : ipsec-tools vulnerability (USN-107-1)	Nessus	Ubuntu Local Security Checks	medium
18903	FreeBSD : racoon -- remote denial-of-service (3b260179-e464-460d-bf9f-d5cda6204020)	Nessus	FreeBSD Local Security Checks	medium
17671	SUSE-SA:2005:020: ipsec-tools	Nessus	SuSE Local Security Checks	medium
17668	Mandrake Linux Security Advisory : ipsec-tools (MDKSA-2005:062)	Nessus	Mandriva Local Security Checks	medium
17655	ipsec-tools KAME racoon Daemon ISAKMP Header Parsing Remote DoS	Nessus	Denial of Service	high
17642	GLSA-200503-33 : IPsec-Tools: racoon Denial of Service	Nessus	Gentoo Local Security Checks	medium
17622	RHEL 4 : ipsec-tools (RHSA-2005:232)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2005-0398

high

Tenable Plugins

medium

medium

medium

medium

high

medium

high