OpenBSD ISAKMP Cert Request payload integer underflow
| openbsd-isakmp-integer-underflow (15629) |  Medium Risk |
Description:
Internet Security Association and Key Management Protocol (ISAKMP), when running in OpenBSD implementations, is vulnerable to a denial of service attack, caused by an integer underflow. By sending a specially-crafted ISAKMP packet containing a malformed Cert Request payload, a remote attacker could cause a denial of service.
Consequences:
Denial of Service
Remedy:
For OpenBSD 3.4:
Apply the 015_isakmpd2.patch, available from the OpenBSD 3.4 errata Web site. See References.
For OpenBSD 3.3:
Apply the 020_isakmpd2.patch, available from the OpenBSD 3.4 errata Web site. See References.
References:
- OpenBSD 3.3 errata Web site: 015: SECURITY FIX: February 5, 2004.
- OpenBSD 3.4 errata Web site: 015: RELIABILITY FIX: March 17, 2004.
- Rapid7, Inc. Security Advisory R7-0018: OpenBSD isakmpd payload handling denial-of-service vulnerabilities.
- BID-10030: OpenBSD ISAKMPD Malformed CERT Request Payload Denial Of Service Vulnerability
- BID-9907: OpenBSD isakmpd Multiple Unspecified Remote Denial Of Service Vulnerabilities
- CVE-2004-0220: isakmpd in OpenBSD 3.4 and earlier allows remote attackers to cause a denial of service via a an ISAKMP packet with a malformed Cert Request payload, which causes an integer underflow that is used in a malloc operation that is not properly handled, as demonstrated by the Striker ISAKMP Protocol Test Suite.
- SECTRACK ID: 1009468: isakmpd Payload Handling Flaw Lets Remote Users Crash the Daemon
- US-CERT VU#223273: Integer underflow vulnerability in isakmpd Certificate Request Payload handling
Platforms Affected:
- OpenBSD OpenBSD 3.3
- OpenBSD OpenBSD 3.4
Reported:
Mar 17, 2004
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net