Vulnerability Note VU#287771

The CERT/CC has received a report describing several vulnerabilities in different vendors' IKE implementations. The IKE protocol (RFC 2409) operates within the framework of the Internet Security Association and Key Management Protocol (ISAKMP, RFC 2408) and provides a way for nodes to authenticate each other and exchange keying material that is used to establish secure network services. IKE is commonly used by IPSec-based VPNs.

During an IKE exchange, some IKE implementations do not properly handle exceptional response packets. The report enumerates several cases:

• IKE represents the ISAKMP security association (SA) in the Security Paramater Index (SPI) field of a response packet. An overly large SPI payload value could trigger a buffer overflow.
• An IKE response packet with a large number of payloads or an overly large payload could trigger buffer overflows.
• An IKE response packet with a payload length of zero could cause vulnerable IKE implementations to consume CPU resources, causing a denial-of-service condition.

An attacker who is able to send solicited IKE responses could execute arbitrary code with the privileges of the IKE service or cause a denial of service. The attacker must act as an IKE responder, so therefore must have control over the responder, the ability to spoof IKE response packets, or the ability to redirect the IKE initiator to a responder controlled by the attacker.

Upgrade or Patch
Upgrade or apply a patch to vulnerable IKE software as specified by your vendor.

Block or Restrict Access

Using a firewall or other packet filtering technology, block or restrict access to the IKE service, 500/udp. Note that blocking access will effectively disable an IPSec-based VPN that relies on IKE for key exchange.