Mandriva Linux Security Advisory : ipsec-tools (MDVSA-2009:112-1)
Medium Nessus Plugin ID 38767
SynopsisThe remote Mandriva Linux host is missing one or more security updates.
Descriptionracoon/isakmp_frag.c in ipsec-tools before 0.7.2 allows remote attackers to cause a denial of service (crash) via crafted fragmented packets without a payload, which triggers a NULL pointer dereference (CVE-2009-1574).
Updated packages are available that brings ipsec-tools to version 0.7.2 for Mandriva Linux 2008.1/2009.0/2009.1 which provides numerous bugfixes over the previous 0.7.1 version, and also corrects this issue. ipsec-tools for Mandriva Linux Corporate Server 4 has been patched to address this issue.
Additionally the flex package required for building ipsec-tools has been fixed due to ipsec-tools build problems and is also available with this update.
Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers
SolutionUpdate the affected packages.