Racoon crypto_openssl.c bypass authentication
| racoon-cryptoopenssl-auth-bypass (15783) |  Medium Risk |
Description:
Racoon could allow a remote attacker to bypass authentication, caused by a vulnerability in the eay_check_x509sign function in the crypto_openssl.c file. By establishing a connection using IKE Phase 1 main mode or aggressive mode, a remote attacker with a valid X.509 certificate, but an invalid private key, could bypass authentication and gain unauthorized access.
Platforms Affected:
- Canonical, Ubuntu 4.10
- Canonical, Ubuntu 5.04
- Canonical, Ubuntu 5.10
- Conectiva, Linux 10
- FreeBSD, FreeBSD 4.9
- Gentoo, Linux
- KAME Project, Racoon
- MandrakeSoft, Mandrake Linux 10.0
- RedHat, Enterprise Linux 3 ES
- RedHat, Enterprise Linux 3 WS
- RedHat, Enterprise Linux 3 AS
Remedy:
For Gentoo Linux:
Upgrade to the latest ipsec-tools package (0.2.5 or later), as listed in GLSA 200404-05. See References.
For Mandrake Linux 10.0:
Upgrade to the latest version of ipsec-tools (0.2.5-0.1.100mdk or later), as listed in MandrakeSoft Security Advisory MDKSA-2004:027 : ipsec-tools . See References.
For Conectiva Linux 10.0:
Upgrade to the latest version of ipsec-tools (0.5.2 or later), as listed in Conectiva Linux Security Announcement CLSA-2005:971. See References.
For Ubuntu Linux:
Refer to USN-221-1 for patch, upgrade, or suggested workaround information. See References.
For other distributions:
Contact your vendor for upgrade or patch information.
Consequences:
Bypass Security
References:
- BugTraq Mailing List, Wed Apr 07 2004 - 11:54:30 CDT, CAN-2004-0155: The KAME IKE Daemon Racoon does not verify RSA Signatures during Phase 1, allows man-in-the-middle attacks and unauthorized connections at http://archives.neohapsis.com/archives/bugtraq/2004-04/0062.html.
- CIAC Information Bulletin O-138, Apple Mac OS X Jaguar and Panther Security Vulnerabilities at http://www.ciac.org/ciac/bulletins/o-138.shtml.
- Conectiva Linux Security Announcement CLSA-2005:971, Fixes for ipsec-tools at http://distro.conectiva.com/atualizacoes/index.php?id=a&anuncio=000971.
- GLSA 200404-05, ipsec-tools contains an X.509 certificates vulnerability. at http://www.linuxsecurity.com/content/view/105913/104/.
- BID-10072: Racoon IKE Daemon Unauthorized X.509 Certificate Connection Vulnerability
- CVE-2004-0155: The KAME IKE Daemon Racoon, when authenticating a peer during Phase 1, validates the X.509 certificate but does not verify the RSA signature authentication, which allows remote attackers to establish unauthorized IP connections or conduct man-in-the-middle attacks using a valid, trusted X.509 certificate.
- GLSA-200404-05: ipsec-tools contains an X.509 certificates vulnerability.
- GLSA-200406-17: IPsec-Tools: authentication bug in racoon
- MDKSA-2004:027: Updated ipsec-tools packages fix vulnerability in racoon
- RHSA-2004-165: ipsec-tools security update
- SA11328: KAME Racoon IKE Daemon RSA Signature Verification Vulnerability
- US-CERT VU#552398: KAME Racoon IKE daemon fails to properly verify client RSA signatures
Reported:
Apr 07, 2004
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
Copyright (c) 1994-2008 Internet Security Systems, Inc. All rights reserved worldwide.
For corrections or additions please email xforce@iss.net