On Tue, Dec 13, 2005 at 09:49:40PM +0100, Paul Wouters wrote:
> On Mon, 12 Dec 2005, Thierry Carrez wrote:
>
> >- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
> >Gentoo Linux Security Advisory GLSA 200512-04
> >- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
> > http://security.gentoo.org/
> >- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
> >
> > Severity: Normal
> > Title: Openswan, IPsec-Tools: Vulnerabilities in ISAKMP Protocol
> > implementation
> > Date: December 12, 2005
> > Bugs: #112568, #113201
> > ID: 200512-04
>
> >Openswan and IPsec-Tools suffer from an implementation flaw which may
> >allow a Denial of Service attack.
>
> That is correct (for openswan)

It is also correct for ipsec-tools, but require a very weak
configuration.

> >Impact
> >======
> >
> >A remote attacker can create a specially crafted packet using 3DES with
> >an invalid key length, resulting in a Denial of Service attack, format
> >string vulnerabilities or buffer overflows.
>
> That's a copy and paste from the IPsec proto testsuite.
>
> 1) It conflicts with the above comment that this is only a DOS
> 2) It's incorrect (for openswan)

Also incorrect for ipsec-tools AFAIK. The only problem we noticed with
protos testsuite was a lack of verification for some payloads
existency in aggressive mode.

> >Workaround
> >==========
> >
> >Avoid using "aggressive mode" in ISAKMP Phase 1, which exchanges
> >information between the sides before there is a secure channel.
>
> In fact, you would to both have aggressive mode enabled AND know the PSK.
> If you have those two enabled, you are vulnerable to a MITM anyway, since
> any client knowing the PSK can pretend to be the IPsec security gateway.

Knowing the PSK is not really needed, as AGGRESSIVE+PSK mode is known
to be quite unsecure, and can be bruteforced offline.

The "workaround" for ipsec-tools is to upgrade, and is only needed for
some people which really have a week configuration and should care
about lots of potential problems !

Yvan, ipsec-tools team.

--
NETASQ - Secure Internet Connectivity
http://www.netasq.com
0?
= *?H?÷

 ?
.0?
*

10 +0 *?H?÷


 ?
?0?0?g 

pƱHkòZ,0
 *?H?÷


0?10 UFR1
0UNord10UVilleneuve d'Ascq1.0,U
%NETASQ - Secure Internet Connectivity1'0%UNETASQ Certification Authority0
050715144443Z
070715144443Z0Ø10 UFR1
0UNord1.0,U
%NETASQ - Secure Internet Connectivity1'0%UNETASQ Certification Authority10UVilleneuve d'Ascq10Uyvan VANHULLEBUS1*0( *?H?÷


yvan.vanhullebus (at) netasq (dot) com0 [email concealed]?
"0
 *?H?÷



?
0?

?

·J®D4¡ï®3ÉS %¾?@¬ô±PO*3ãs~£?hÆ?#ßþf
dä«q??í?£ô°?Ý¥ëïctâqûW÷!4ŸÝjÆ,ç?{kÈìöölÂp \}ÛÑ!/@?²þx)a¬d?Èïb?¬L)8Xî%;ʼüÊ?4¢Å|á?Ïrmi¸7~YoÉ=èTQ2á^¬/?$ø?w
p";aï
+T?fIP?!2¥^âúxl?éOÔ+¿qÇÄ?¦?iKÎ !{??Ë¡~¼Uÿv 0g{£Zá(£?¢:º¦Ô?ìì?}íïÊ?IÎÇZfá

£??0??0U

ÿ00Uü$?IÖMf»°)U¨OÌêt?0¾U#¶0³?'*ëÙDÚ:sj É%¨ù²¡?¤?0?10 UFR1
0UNord10UVilleneuve d'Ascq1.0,U
%NETASQ - Secure Internet Connectivity1'0%UNETASQ Certification Authority?
0U

ÿà0 `?H
?øB

 0+ +

?7SmartcardLogon0,U%

ÿ"0 +
+

+

?70+U$0"  
+

?7 yvanv (at) netasq (dot) com0 [email concealed]ÍUÅ0Â0Z X V?Tldap://pki.netasq.com/cn=fwca,ou=
cas,o=netasq,dc=fr?certificateRevocationList;binary08 6 4?2http://intran
et.netasq.com/intranet/pki/netasq.crl0* ( &?$http://www.netasq.com/pki/n
etasq.crl0 `?H
?øB

User Certificate0
 *?H?÷


?

2Wî ?OýÊErÈÇHÜGýlæèc¬?ñ+ù$öÝ#¼i·)9U7k®gAäUMZ¬:?óèsY??ãÏYóVà1ÆiöȪâ´3(Ü
{°dy?ZM"?¹Í&??WÓºÅ??º_?º@WÈ®?¬_ÑP°?õ"º×8SgE??x¹(¯Ì% ½??«F8® ýKKó?Û=Ì?q¸il*DÍÔ¼Ò««EY?­ï£¯Ìeó?ûSö­C?"F·)? ?¹è?!Ñû?:?L7ÜMV«¤!a#o?È1S½?Ò6?û¶?¼ÄbñóѸo?Eß?0?0?ê 

0
 *?H?÷


0?10 UFR1
0UNord10UVilleneuve d'Ascq1.0,U
%NETASQ - Secure Internet Connectivity1'0%UNETASQ Certification Authority0
020219123455Z
220214123455Z0?10 UFR1
0UNord10UVilleneuve d'Ascq1.0,U
%NETASQ - Secure Internet Connectivity1'0%UNETASQ Certification Authority0?
"0
 *?H?÷



?
0?

?

Á?O?zÞ«t¶âL¢>Qà~ìkå?I???Ǎ?y{£ú,æò®W?ê?E
?k?J?Ô°Íùç?·ÅÍKÙ
òÅÀºf ­Ñ
á?"úàk¬½øîAøP÷ë#¢¯­?¤mØÀVT+îËfØôtê~ ½Ø??·&?ákÖ'Å´6ªKMRË=ɏªõÕߺUòü ?õdqôÙp,?¥?a æÒ=ôR¶Úëb¬+áéÁ·©&=Lo?e
Z H¢hCeT®èøÒ׺?q?ÎYð?¶?+#5Íþ?÷ÅGMÿ?©¼%<ÃûÍÇÚâ_¹ø~9ýÀ¼çÂ?\6Ç

£
c0a0U'*ëÙDÚ:sj É%¨ù²0U#0?'*ëÙDÚ:sj É%¨ù²0U

ÿ0

ÿ0U

ÿ
0
 *?H?÷


?

?%¨SZ¦&?Æe]¦ëâ?@Ú¿L®?,1óÁ?\Ê9ôB£þÅihMi!.?Ì°Î?
wÞô4¥?3Éê?«q-3?
%æá?F-?|_c9M×?D?8ÎUW0éhüHa??êÍ&ÜÔÎñ?E~¼µù1¥??9D/­ö?é?×Ô 7 P(?æ(õU¼I²R¤]5?qIRÜ«H¥¬A´??,Xß±k?_6>;õüR2T§(?ñ?³ÂËP_`a,H´ºIF?¤
TÆ?NGh,A+bÝ&þwúÐ731zCù¥e-?U»°î¤¤û?(aÎ1?|0?x

0 0?10 UFR1
0UNord10UVilleneuve d'Ascq1.0,U
%NETASQ - Secure Internet Connectivity1'0%UNETASQ Certification Authority
pƱHkòZ,0 + ±0 *?H?÷

1 *?H?÷


0 *?H?÷

1
051214102437Z0# *?H?÷

1?1g¿L ´çª­Gäîf1ì40R *?H?÷

1E0C0
*?H?÷
0*?H?÷
?0
*?H?÷

@0+0
*?H?÷

(0
 *?H?÷



?
?eúí`?ÊÊ'êÁ6¿´y]»?Vʾ{ô=اn2êr?ãg?<ÑÿQÖòøE?|[ø`{%j£82â~jô7°=»?åA-3Á«øatë?aæ¼>Dº¦óvÁ¤2?ÁÙ?þ?µ
ÿæìó?¶tUE¨??´1ö?»3l/#<?A¶V½w²¢!Lâ_+ÃÐ#pÈLÍAvû:?íIʦgA¦<¿ec$[È??âs¸ñ¸§mýg~ÖJ¹XãJî45íÚZrĹp?TÃêâÍ?;?
ZðpÅ"ðY8QÊr$ -ǽÐ?WLÚ?BØPx×ˁVKwCGLÆD?
d

[ reply ]