The isakmp_info_recv function in src/racoon/isakmp_inf.c in racoon in Ipsec-tools before 0.6.7 allows remote attackers to cause a denial of service (tunnel crash) via crafted (1) DELETE (ISAKMP_NPTYPE_D) and (2) NOTIFY (ISAKMP_NPTYPE_N) messages.

The remote Oracle Linux 5 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2007-0342 advisory.

    [0.6.5-8]
     - Upstream fix for Racoon DOS, informational delete must be encrypted
     - Resolves: rhbz#235388 - CVE-2007-1841 ipsec-tools racoon DoS

     [0.6.5-7]
     - Resolves: #218386 labeled ipsec does not work over loopback

     [0.6.5-6.6]
     - Related: #232508 add auditing to racoon

     [0.6.5-6.5]
     - Resolves: #235680 racoon socket descriptor exhaustion

     [0.6.5-6.4]
     - Resolves: #236121 increase buffer for context

     [0.6.5-6.3]
     - Resolves: #234491 kernel sends ACQUIRES that racoon is not catching
     - Resolves: #218386 labeled ipsec does not work over loopback


     [0.6.5-6.2.el5]
     - fix for setting the security context into a proposal (32<->64bit)
     - Resolves: rhbz#232508

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A denial of service flaw was found in the ipsec-tools racoon daemon.
It was possible for a remote attacker, with knowledge of an existing ipsec tunnel, to terminate the ipsec connection between two machines.
(CVE-2007-1841)

Updated ipsec-tools packages that fix a denial of service flaw in racoon are now available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The ipsec-tools package is used in conjunction with the IPsec functionality in the linux kernel and includes racoon, an IKEv1 keying daemon.

A denial of service flaw was found in the ipsec-tools racoon daemon.
It was possible for a remote attacker, with knowledge of an existing ipsec tunnel, to terminate the ipsec connection between two machines.
(CVE-2007-1841)

Users of ipsec-tools should upgrade to these updated packages, which contain a backported patch that resolves this issue.

A bug in the IKE daemon 'racoon' allowed remote attackers shut down established tunnels. (CVE-2007-1841)

This update fixes a security problem in novell-ipsec-tools :

CVE-2007-1841: Fix a DoS in isakmp_info_recv

and also a non-security bug with a crash in GSSAPI.

A flaw was discovered in the IPSec key exchange server 'racoon'.
Remote attackers could send a specially crafted packet and disrupt established IPSec tunnels, leading to a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A bug in the IKE daemon 'racoon' allowed remote attackers shut down established tunnels (CVE-2007-1841).

It was discovered that a specially crafted packet sent to the racoon ipsec key exchange server could cause a tunnel to crash, resulting in a denial of service.

The oldstable distribution (sarge) isn't affected by this problem.

The remote host is affected by the vulnerability described in GLSA-200705-09 (IPsec-Tools: Denial of Service)

    The isakmp_info_recv() function in src/racoon/isakmp_inf.c does not     always check that DELETE (ISAKMP_NPTYPE_D) and NOTIFY (ISAKMP_NPTYPE_N)     packets are encrypted.
  Impact :

    A remote attacker could send a specially crafted IPsec message to one     of the two peers during the beginning of phase 1, resulting in the     termination of the IPsec exchange.
  Workaround :

    There is no known workaround at this time.

The ipsec-tools package prior to version 0.6.7 allows remote attackers to cause a Denial of Service (tunnel crash) via crafted DELTE and NOTIFY messages.

Updated packages have been patched to correct this issue.

ID	Name	Product	Family	Severity
67490	Oracle Linux 5 : Moderate: / ipsec-tools (ELSA-2007-0342)	Nessus	Oracle Linux Local Security Checks	high
60183	Scientific Linux Security Update : ipsec-tools on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
43640	CentOS 5 : ipsec-tools (CESA-2007:0342)	Nessus	CentOS Local Security Checks	medium
41125	SuSE9 Security Update : ipsec-tools (YOU Patch Number 11491)	Nessus	SuSE Local Security Checks	medium
30016	openSUSE 10 Security Update : novell-ipsec-tools (novell-ipsec-tools-4655)	Nessus	SuSE Local Security Checks	medium
29466	SuSE 10 Security Update : ipsec-tools (ZYPP Patch Number 3099)	Nessus	SuSE Local Security Checks	medium
28047	Ubuntu 5.10 / 6.06 LTS / 6.10 : ipsec-tools vulnerability (USN-450-1)	Nessus	Ubuntu Local Security Checks	medium
27273	openSUSE 10 Security Update : ipsec-tools (ipsec-tools-3098)	Nessus	SuSE Local Security Checks	medium
25455	Debian DSA-1299-1 : ipsec-tools - missing input sanitising	Nessus	Debian Local Security Checks	medium
25330	RHEL 5 : ipsec-tools (RHSA-2007:0342)	Nessus	Red Hat Local Security Checks	medium
25186	GLSA-200705-09 : IPsec-Tools: Denial of Service	Nessus	Gentoo Local Security Checks	medium
25062	Mandrake Linux Security Advisory : ipsec-tools (MDKSA-2007:084)	Nessus	Mandriva Local Security Checks	medium

Detections

Analytics

CVE-2007-1841

high

Tenable Plugins

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium