The default IPSec ifup script in Red Hat Enterprise Linux 3 through 5 configures racoon to use aggressive IKE mode instead of main IKE mode, which makes it easier for remote attackers to conduct brute force attacks by sniffing an unencrypted preshared key (PSK) hash.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The default IPSec ifup script in Red Hat Enterprise Linux 3 through 5 configures racoon to use aggressive     IKE mode instead of main IKE mode, which makes it easier for remote attackers to conduct brute force     attacks by sniffing an unencrypted preshared key (PSK) hash. (CVE-2008-1198)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Oracle Linux 5 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2012-0312 advisory.

    [8.45.42-1.0.1.el5]
    - Update oracle-enterprise.patch to do detection on /etc/oracle-release       and /etc/enterprise-release
    - Patch x86_64 sysctl.conf as well as default sysctl.conf
    - Patch sysctl.conf to default rp_filter to loose reverse path       filtering (has no effect for pre-2.6.32 kernels) [orabug 10286227]
    - Move hwclock into udev rules
    - Update oracle-enterprise.patch to fix RedHat references in arch specific       sysctl.conf files in source tarball
    - Add oracle-enterprise.patch and update specfile
    - Don't attempt to re-enslave already-enslaved devices (#455537) (pknirsch@redhat.com)

    [8.45.42-1]
    - changed exchange_mode to 'main, aggressive' (#435274)

    [8.45.41-1]
    - fix check for dhcp6c pid (#568896)

    [8.45.40-1]
    - exit arping on first response (#744734)

    [8.45.39-1]
    - suppress remove error message during boot (#679998)
    - fix logic error with removing arp_ip_target (#745681)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The initscripts package contains system scripts to boot your system, change runlevels, activate and deactivate most network interfaces, and shut the system down cleanly.

With the default IPsec (Internet Protocol Security) ifup script configuration, the racoon IKE key management daemon used aggressive IKE mode instead of main IKE mode. This resulted in the preshared key (PSK) hash being sent unencrypted, which could make it easier for an attacker able to sniff network traffic to obtain the plain text PSK from a transmitted hash. (CVE-2008-1198)

This update also fixes the following bugs :

  - Prior to this update, the DHCPv6 client was not     terminated when the network service was stopped. This     update modifies the source so that the client is now     terminated when stopping the network service.

  - Prior to this update, on some systems the rm command     failed and reported the error message 'rm: cannot remove     directory `/var/run/dovecot/login/': Is a directory'     during system boot. This update modifies the source so     that this error message no longer appears.

  - Prior to this update, the netconsole script could not     discover and resolve the MAC address of the router     specified in the /etc/sysconfig/netconsole file. This     update modifies the netconsole script so that the script     no longer fails when the arping tool returns the MAC     address of the router more than once.

  - Prior to this update, the arp_ip_target was, due to a     logic error, not correctly removed via sysfs. As a     consequence, the error 'ifdown-eth: line 64: echo: write     error: Invalid argument' was reported when attempting to     shut down a bonding device. This update modifies the     script so that the error no longer appears and     arp_ip_target is now correctly removed.

All users of initscripts are advised to upgrade to this updated package, which fixes these issues.

The remote Redhat Enterprise Linux 5 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2012:0312 advisory.

  - initscripts: IPSec ifup script allows for aggressive IKE mode (CVE-2008-1198)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
217068	Linux Distros Unpatched Vulnerability : CVE-2008-1198	Nessus	Misc.	critical
68483	Oracle Linux 5 : initscripts (ELSA-2012-0312)	Nessus	Oracle Linux Local Security Checks	high
61263	Scientific Linux Security Update : initscripts on SL5.x i386/x86_64 (20120221)	Nessus	Scientific Linux Local Security Checks	high
58066	RHEL 5 : initscripts (RHSA-2012:0312)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2008-1198

critical

Tenable Plugins

critical

high

high

critical