--45Z9DzgjV8m4Oswq
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Tue, Dec 13, 2005 at 09:49:40PM +0100, Paul Wouters wrote:
> On Mon, 12 Dec 2005, Thierry Carrez wrote:
>=20
> >- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
> >Gentoo Linux Security Advisory GLSA 200512-04
> >- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
> > http://security.gentoo.org/
> >- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
> >
> > Severity: Normal
> > Title: Openswan, IPsec-Tools: Vulnerabilities in ISAKMP Protocol
> > implementation
> > Date: December 12, 2005
> > Bugs: #112568, #113201
> > ID: 200512-04
>=20
> >Openswan and IPsec-Tools suffer from an implementation flaw which may
> >allow a Denial of Service attack.
>=20
> That is correct (for openswan)

It is also correct for ipsec-tools, but require a very weak
configuration.


> >Impact
> >=3D=3D=3D=3D=3D=3D
> >
> >A remote attacker can create a specially crafted packet using 3DES with
> >an invalid key length, resulting in a Denial of Service attack, format
> >string vulnerabilities or buffer overflows.
>=20
> That's a copy and paste from the IPsec proto testsuite.
>=20
> 1) It conflicts with the above comment that this is only a DOS
> 2) It's incorrect (for openswan)

Also incorrect for ipsec-tools AFAIK. The only problem we noticed with
protos testsuite was a lack of verification for some payloads
existency in aggressive mode.


> >Workaround
> >=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
> >
> >Avoid using "aggressive mode" in ISAKMP Phase 1, which exchanges
> >information between the sides before there is a secure channel.
>=20
> In fact, you would to both have aggressive mode enabled AND know the PSK.
> If you have those two enabled, you are vulnerable to a MITM anyway, since
> any client knowing the PSK can pretend to be the IPsec security gateway.

Knowing the PSK is not really needed, as AGGRESSIVE+PSK mode is known
to be quite unsecure, and can be bruteforced offline.

The "workaround" for ipsec-tools is to upgrade, and is only needed for
some people which really have a week configuration and should care
about lots of potential problems !


Yvan, ipsec-tools team.

--=20
NETASQ - Secure Internet Connectivity
http://www.netasq.com

--45Z9DzgjV8m4Oswq
Content-Type: application/x-pkcs7-signature
Content-Disposition: attachment; filename="smime.p7s"
Content-Transfer-Encoding: base64

MIINPQYJKoZIhvcNAQcCoIINLjCCDSoCAQExCzAJBgUrDgMCGg UAMAsGCSqGSIb3DQEHAaCC
CokwggZ/MIIFZ6ADAgECAgpwxrFIFmvykFosMA0GCSqGSIb3DQEBBAUAMI GRMQswCQYDVQQG
EwJGUjENMAsGA1UECBMETm9yZDEaMBgGA1UEBxMRVmlsbGVuZX V2ZSBkJ0FzY3ExLjAsBgNV
BAoTJU5FVEFTUSAtIFNlY3VyZSBJbnRlcm5ldCBDb25uZWN0aX ZpdHkxJzAlBgNVBAsTHk5F
VEFTUSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wNTA3MT UxNDQ0NDNaFw0wNzA3MTUx
NDQ0NDNaMIHYMQswCQYDVQQGEwJGUjENMAsGA1UECBMETm9yZD EuMCwGA1UEChMlTkVUQVNR
IC0gU2VjdXJlIEludGVybmV0IENvbm5lY3Rpdml0eTEnMCUGA1 UECxMeTkVUQVNRIENlcnRp
ZmljYXRpb24gQXV0aG9yaXR5MRowGAYDVQQHExFWaWxsZW5ldX ZlIGQnQXNjcTEZMBcGA1UE
AxMQeXZhbiBWQU5IVUxMRUJVUzEqMCgGCSqGSIb3DQEJARYbeX Zhbi52YW5odWxsZWJ1c0Bu
ZXRhc3EuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCg KCAQEAt0quG0Q0oe+uM8lT
HAklvpFArPSxUE8qM+NzfqOUaMaAI9/+Zg1kFOSrcYYRnB0R7ZGj9H+wk92l6+9jdOJx+1cG
9wwhCzTFuN1qxiznhXtryOwZ9vZswnAJXH3b0R0hL0CUsv54KW GsZIDI72KHrEx/KThY7iU7
AMq8/MqGGjSixXzhm89ybWm4N36dWRJvyT3oHFRREDLhGhherC+FJPi ed4FwIjth7worVD9m
SVAPgp0WHpAhMqVe4vp4bJvpT9Qrv38cccfEiaaFaUvOCSF7h5 gXy6F+D7xV/3adGqAwZ3sI
o1qN4SijkaI6uqbUP+zslX3t78qHSc7HWhVm4QIDAQABo4ICjj CCAoowDAYDVR0TAQH/BAIw
ADAdBgNVHQ4EFgQU/CR/mkkP1k1mu7ApVahPzBnqdJowgb4GA1UdIwSBtjCBs4AUJyrrHd lE
2joXc2oJICDJJaj5f7KhgZekgZQwgZExCzAJBgNVBAYTAkZSMQ 0wCwYDVQQIEwROb3JkMRow
GAYDVQQHExFWaWxsZW5ldXZlIGQnQXNjcTEuMCwGA1UEChMlTk VUQVNRIC0gU2VjdXJlIElu
dGVybmV0IENvbm5lY3Rpdml0eTEnMCUGA1UECxMeTkVUQVNRIE NlcnRpZmljYXRpb24gQXV0
aG9yaXR5ggEAMA4GA1UdDwEB/wQEAwIF4DARBglghkgBhvhCAQEEBAMCBaAwKwYJKwYBBAGC
NxQCBB4eHABTAG0AYQByAHQAYwBhAHIAZABMAG8AZwBvAG4wLA YDVR0lAQH/BCIwIAYIKwYB
BQUHAwQGCCsGAQUFBwMCBgorBgEEAYI3FAICMCsGA1UdEQQkMC KgIAYKKwYBBAGCNxQCA6AS
DBB5dmFudkBuZXRhc3EuY29tMIHNBgNVHR8EgcUwgcIwWqBYoF aGVGxkYXA6Ly9wa2kubmV0
YXNxLmNvbS9jbj1md2NhLG91PWNhcyxvPW5ldGFzcSxkYz1mcj 9jZXJ0aWZpY2F0ZVJldm9j
YXRpb25MaXN0O2JpbmFyeTA4oDagNIYyaHR0cDovL2ludHJhbm V0Lm5ldGFzcS5jb20vaW50
cmFuZXQvcGtpL25ldGFzcS5jcmwwKqAooCaGJGh0dHA6Ly93d3 cubmV0YXNxLmNvbS9wa2kv
bmV0YXNxLmNybDAfBglghkgBhvhCAQ0EEhYQVXNlciBDZXJ0aW ZpY2F0ZTANBgkqhkiG9w0B
AQQFAAOCAQEAMlfufwmHT/3KRXLIx0jcRwT9bOboCGMQrI7xK/kk9t0jvGm3KTlVN2uuZ0Hk
VU2QWqw6hPPoc1mclOPPWfNW4DHGafbIAqritDMoAtwCe7BkeZ FaTRcigrnNJhyIjlfTHrrF
Pz8Iul+ZugtAV8gCrpMPrF/RUJ2wgvUiBrp/1zhTZ0WMini5KK/MEiWgvZKHq0Y4riD9Sw5L
84TbPcwQmHG4aQhsKkTNC9S80qurRVmTre+Qo68fzGXznPsSU/atH0OCIka3KYcJmrnoFosh
0fuWOhKRTDfcTVarpCFhFiNvg8gxUxi9kdI2m/u2h7zEYvEH89G4HQ6NFBNvh0XfjjCCBAIw
ggLqoAMCAQICAQAwDQYJKoZIhvcNAQEEBQAwgZExCzAJBgNVBA YTAkZSMQ0wCwYDVQQIEwRO
b3JkMRowGAYDVQQHExFWaWxsZW5ldXZlIGQnQXNjcTEuMCwGA1 UEChMlTkVUQVNRIC0gU2Vj
dXJlIEludGVybmV0IENvbm5lY3Rpdml0eTEnMCUGA1UECxMeTk VUQVNRIENlcnRpZmljYXRp
b24gQXV0aG9yaXR5MB4XDTAyMDIxOTEyMzQ1NVoXDTIyMDIxND EyMzQ1NVowgZExCzAJBgNV
BAYTAkZSMQ0wCwYDVQQIEwROb3JkMRowGAYDVQQHExFWaWxsZW 5ldXZlIGQnQXNjcTEuMCwG
A1UEChMlTkVUQVNRIC0gU2VjdXJlIEludGVybmV0IENvbm5lY3 Rpdml0eTEnMCUGA1UECxMe
TkVUQVNRIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIIBIjANBg kqhkiG9w0BAQEFAAOCAQ8A
MIIBCgKCAQEAwYBPi3ref6t0tuJMoj5R4H7sa+WMSZwDh4XHjZ V5e6P6LObyrleC6oNFDZJr
gBtKk9Swzfnnf4m3xc0QS9kKCPLFwLpmIK3RCx0K4YYi+uBrrL 347kH4UPfrI6KvrYcFpG3Y
wFZUK+7LZn/Y9HSB6n4gvdiCk7cmkuFr1ifFtDYZqktNUss9yQCPqh0d9dXfu hRV8vyggvVk
cfTZcCyVpRaDYaDm0j30Urba62KsKxfh6cEAt6kmPUxviGVaoE iiaABDZVSu6PjS17qDcZaQ
zlnwhLacKyM1zR7+lvfFR03/h6m8JYGBPMP7zccH2uJfufh+Of3AvOfCFZFcNhzHCwIDAQAB
o2MwYTAdBgNVHQ4EFgQUJyrrHdlE2joXc2oJICDJJaj5f7IwHw YDVR0jBBgwFoAUJyrrHdlE
2joXc2oJICDJJaj5f7IwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZI
hvcNAQEEBQADggEBAJclqFN/WqYmhcZlXabrw6KJQNq/TK6TLDHzwZVcyjn0QhujHRr+EcVp
aE1pIS4fjsywzpINE3fe9DSlC4IzyeqDq3EtM4eQDSXm4YRGLZ p8X2M5TdccmxlElDgZzlVX
MOlo/Ehhh4vqzSbc1M4FEfETiEV+vLX5MaWEHH8dmzlEL632mOme19Q JN6BQKJPmCCj1VbxJ
DrJSpF01kXFJUtyrA0ilrEG0mA+FLFjfsWuZXzYEPjv1/FIPMlSnCCiW8ZSzwstQX2BhLEi0
ugZJRpakVMY/TkdoLEErYt0mjZD+d/oXFR7QNzMxAHpDEPmlZRotP1W7sO6kpBP7lyh/Yc4x
ggJ8MIICeAIBATCBoDCBkTELMAkGA1UEBhMCRlIxDTALBgNVBA gTBE5vcmQxGjAYBgNVBAcT
EVZpbGxlbmV1dmUgZCdBc2NxMS4wLAYDVQQKEyVORVRBU1EgLS BTZWN1cmUgSW50ZXJuZXQg
Q29ubmVjdGl2aXR5MScwJQYDVQQLEx5ORVRBU1EgQ2VydGlmaW NhdGlvbiBBdXRob3JpdHkC
CnDGsUgWa/KQWiwwCQYFKw4DAhoFAKCBsTAYBgkqhkiG9w0BCQMxCwYJKoZI hvcNAQcBMBwG
CSqGSIb3DQEJBTEPFw0wNTEyMTQxMDI0MzdaMCMGCSqGSIb3DQ EJBDEWBBSEMRdnv0wgtOcG
qq1H5O4dZjHsNDBSBgkqhkiG9w0BCQ8xRTBDMAoGCCqGSIb3DQ MHMA4GCCqGSIb3DQMCAgIA
gDANBggqhkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAg IBKDANBgkqhkiG9w0BAQEF
AASCAQCeZfrtYJjKyifqwTa/tHkUXbuYVsq+e/Q92KduDDLqcj/jZweCPNH/Udby+EWFfFv4
YHslFmqjODLifmr0N7A9gbua5UEtGjPBq434YRd065Rh5rw+RL qm83YTwaQyhMHZk/6Ctf/m
7POMtnRVRQCoip+0MfaZuzNsLyM8HJ9BthsVVr13sqIhTOJfKw zD0CNwHMhMzUF2+zqR7UnK
pmdBphY8v2VjJBdbyICW4nO48binbf0cZwV+1kq5WONK7jQ1GO 3aBVpyxB65cD9Uw+rizZQ7
hh5a8HDFIvBZOFHKciQgjS3HvdCAV0zalkLYUHjXy4FWS3dDf0 eQTMZEhQpk

--45Z9DzgjV8m4Oswq--