Note to Racoon users (IKE/ISAKMP daemon)

From: Jacques A. Vidrine (nectar_at_FreeBSD.org)
Date: 04/07/04

  • Next message: Jacques A. Vidrine: "Changing `security@freebsd.org' alias"
    Date: Wed, 7 Apr 2004 08:09:31 -0500
    To: freebsd-security@FreeBSD.org
    
    

    As was accidently posted here earlier by Ralf :-), you should be aware
    of this issue:

    http://vuxml.freebsd.org/d8769838-8814-11d8-90d1-0020ed76ef5a.html

      racoon fails to verify signature during Phase 1

      Affected packages
        racoon < 20040407b

      Details

      VuXML ID d8769838-8814-11d8-90d1-0020ed76ef5a
      Discovery 2004-04-05
      Entry 2004-04-07

      Ralf Spenneberg discovered a serious flaw in racoon. When using
      Phase 1 main or aggressive mode, racoon does not verify the client's
      RSA signature. Any installations using X.509 authentication are
      strongly urged to upgrade.

      Installations using pre-shared keys are believed to be unaffected.

      References

      CVE CAN-2004-0155
      Name
      URL http://www.kame.net/dev/cvsweb2.cgi/kame/kame/kame/racoon/
            crypto_openssl.c?rev=1.84&content-type=text/x-cvsweb-markup

    -- 
    Jacques Vidrine / nectar@celabo.org / jvidrine@verio.net / nectar@freebsd.org
    _______________________________________________
    freebsd-security@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-security
    To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org"
    

  • Next message: Jacques A. Vidrine: "Changing `security@freebsd.org' alias"