Bug 238052 - (CVE-2007-1841) CVE-2007-1841 ipsec-tools racoon DoS
CVE-2007-1841 ipsec-tools racoon DoS
Status: CLOSED CURRENTRELEASE
Product: Fedora
Classification: Fedora
Component: ipsec-tools (Show other bugs)
6
All Linux
high Severity high
: ---
: ---
Assigned To: Steve Conklin
source=vendorsec,reported=20070331,pu...
: Security
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2007-04-26 16:22 EDT by Josh Bressers
Modified: 2007-11-30 17:12 EST (History)
4 users (show)

See Also:
Fixed In Version: ipsec-tools-0.6.6-6.fc7
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2007-11-01 16:41:46 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Josh Bressers 2007-04-26 16:22:50 EDT
+++ This bug was initially created as a clone of Bug #235388 +++

Apple reported a denial of service flaw in the ipsec-tools racoon.  It is
possible for a remote attacker to invalidate an ipsec tunnel between two
machines.  According to upstream:

Anybody who can:

- guess that A and B have established an IPSec tunnel
- guess some basic informations about phase1 (or who is ready to do
  some quick bruteforce....) 
- send packed to A which appears to come from B

Can invalidate that tunnel at any time.

-- Additional comment from bressers@redhat.com on 2007-04-05 11:11 EST --
Created an attachment (id=151768)
Proposed upstream patch
Comment 1 Josh Bressers 2007-04-26 16:24:19 EDT
This flaw should also affect FC5
Comment 2 Lubomir Kundrak 2007-08-02 08:31:08 EDT
Steve: please do push an update for FC6. Thanks.
Comment 3 Michael Forrest 2007-08-05 01:28:56 EDT
Because this only fixed in upstream ipsec-tools 0.6.7, Fedora 7 (at version
0.6.6) may also be vulnerable.

Comment 4 Lubomir Kundrak 2007-08-08 09:55:09 EDT
Raising priority. This needs to be fixed.
Comment 5 Steve Conklin 2007-08-14 13:42:17 EDT
This has been pushed as a fedora testing update, version ipsec-tools-0.6.5-8.fc6

After a few days, I'll push to the fedora update.
Comment 6 Lubomir Kundrak 2007-08-20 12:07:09 EDT
Steve: Could you please proceed pushing, unless you have a strong reason not to?
Comment 7 Steve Grubb 2007-08-27 13:22:35 EDT
A new package was pushed to release team last week.

Note You need to log in before you can comment on or make changes to this bug.