Skip site navigation (1)Skip section navigation (2)
Date:      Wed, 7 Apr 2004 08:09:31 -0500
From:      "Jacques A. Vidrine" <nectar@FreeBSD.org>
To:        freebsd-security@FreeBSD.org
Subject:   Note to Racoon users (IKE/ISAKMP daemon)
Message-ID:  <20040407130931.GA62723@madman.celabo.org>

next in thread | raw e-mail | index | archive | help
As was accidently posted here earlier by Ralf :-), you should be aware
of this issue:

http://vuxml.freebsd.org/d8769838-8814-11d8-90d1-0020ed76ef5a.html

  racoon fails to verify signature during Phase 1

  Affected packages
    racoon < 20040407b

  Details

  VuXML ID  d8769838-8814-11d8-90d1-0020ed76ef5a
  Discovery 2004-04-05
  Entry     2004-04-07

  Ralf Spenneberg discovered a serious flaw in racoon. When using
  Phase 1 main or aggressive mode, racoon does not verify the client's
  RSA signature. Any installations using X.509 authentication are
  strongly urged to upgrade.

  Installations using pre-shared keys are believed to be unaffected.

  References

  CVE   CAN-2004-0155
  Name
  URL   http://www.kame.net/dev/cvsweb2.cgi/kame/kame/kame/racoon/
	crypto_openssl.c?rev=1.84&content-type=text/x-cvsweb-markup

-- 
Jacques Vidrine / nectar@celabo.org / jvidrine@verio.net / nectar@freebsd.org



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20040407130931.GA62723>