Vulnerability Note VU#459371

Multiple IPsec implementations do not adequately validate authentication data

Overview

IPsec implementations from multiple vendors do not adequately validate the authentication data in IPsec packets, exposing vulnerable systems to a denial of service.

I. Description

For background:

RFC 2401 Security Architecture for the Internet Protocol
RFC 2402 IP Authentication Header
RFC 2406 IP Encapsulating Security Payload

IPsec supports integrity and authentication for IP traffic by including a cryptographic checksum in each IPsec datagram. This authentication data is compared to the Integrity Check Value (ICV) that is calculated by the recipient. If the values match, the datagram is considered valid.

BindView RAZOR has reported a vulnerability that exists in KAME (FreeBSD, NetBSD), FreeS/WAN (Linux), and possibly other IPsec implementations. While processing an IPsec datagram, vulnerable implementations do not properly calculate the length of the authentication data field for very small datagrams, resulting in an unsigned integer overflow. The ICV is then calculated for an overly large range of memory, which could cause a kernel panic on vulnerable systems.

KAME, FreeBSD, and NetBSD are vulnerable due to the way they handle Encapsulating Security Payload (ESP) datagrams.

II. Impact

A remote attacker could crash a vulnerable system with a specially crafted IPsec packet. The attacker would need to supply the source and destination IP addresses, the Security Parameters Index (SPI), and a suitably large sequence number. All of this information is transmitted in plain text.

III. Solution

Upgrade or Apply a Patch

Upgrade or apply a patch as specified by your vendor(s).

Restrict Access

When possible, restrict access to IPsec hosts and gateways. Note that this will not prevent attacks, it will only limit the number of potential sources.

Systems Affected

Vendor	Status	Date Updated
Alcatel	Not Vulnerable	15-Oct-2002
Apple Computer Inc.	Vulnerable	15-Oct-2002
Avaya	Not Vulnerable	11-Dec-2002
Borderware	Not Vulnerable	18-Oct-2002
Cisco Systems Inc.	Not Vulnerable	21-Oct-2002
Clavister	Not Vulnerable	22-Aug-2002
Conectiva	Unknown	29-Aug-2002
Cray Inc.	Not Vulnerable	15-Oct-2002
Data General	Unknown	29-Aug-2002
Debian	Vulnerable	11-Dec-2002
eSoft	Vulnerable	15-Oct-2002
Extreme Networks	Unknown	15-Oct-2002
F-Secure	Unknown	29-Aug-2002
FreeBSD	Vulnerable	15-Oct-2002
FreeS/WAN	Vulnerable	2-Dec-2002
Fujitsu	Unknown	29-Aug-2002
Global Technology Associates	Vulnerable	17-Oct-2002
Guardian Digital Inc.	Unknown	29-Aug-2002
Hewlett-Packard Company	Not Vulnerable	15-Oct-2002
Hitachi	Not Vulnerable	15-Oct-2002
IBM	Vulnerable	11-Dec-2002
Internet Initiative Japan (IIJ)	Vulnerable	11-Dec-2002
Intoto	Not Vulnerable	18-Oct-2002
Juniper Networks	Unknown	29-Aug-2002
KAME Project	Vulnerable	15-Oct-2002
Lucent	Not Vulnerable	15-Oct-2002
MandrakeSoft	Unknown	29-Aug-2002
Microsoft Corporation	Not Vulnerable	17-Oct-2002
MontaVista Software	Not Vulnerable	21-Oct-2002
NEC Corporation	Vulnerable	11-Dec-2002
NetBSD	Vulnerable	22-Oct-2002
NetScreen	Not Vulnerable	29-Aug-2002
Network Appliance	Not Vulnerable	15-Oct-2002
Network Associates	Unknown	29-Aug-2002
NeXT	Unknown	29-Aug-2002
NIST	Unknown	29-Aug-2002
Nortel Networks	Not Vulnerable	11-Dec-2002
Novell	Unknown	11-Dec-2002
OpenBSD	Unknown	29-Aug-2002
Openwall GNU/*/Linux	Not Vulnerable	21-Oct-2002
PGP	Unknown	29-Aug-2002
Red Hat Inc.	Unknown	29-Aug-2002
SafeNet	Not Vulnerable	15-Oct-2002
Sequent	Unknown	29-Aug-2002
SGI	Unknown	29-Aug-2002
Sony Corporation	Unknown	29-Aug-2002
SSH Communications Security	Not Vulnerable	11-Dec-2002
Sun Microsystems Inc.	Not Vulnerable	29-Aug-2002
SuSE Inc.	Unknown	29-Aug-2002
The SCO Group (SCO Linux)	Unknown	29-Aug-2002
Unisys	Unknown	29-Aug-2002
Wind River Systems Inc.	Unknown	29-Aug-2002

References

http://razor.bindview.com/publish/advisories/adv_ipsec.html
http://www.ietf.org/rfc/rfc2401.txt
http://www.ietf.org/rfc/rfc2402.txt
http://www.ietf.org/rfc/rfc2406.txt

Credit

The CERT/CC thanks Todd Sabin of BindView RAZOR for discovering and reporting this issue.

This document was written by Art Manion.

Other Information

Date Public	10/17/2002
Date First Published	10/17/2002 05:55:11 PM
Date Last Updated	01/06/2003
CERT Advisory
CVE Name	CAN-2002-0666
US-CERT Technical Alerts
Metric	5.14
Document Revision	24

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader