Vulnerability Note VU#886601

Internet Key Exchange (IKE) protocol discloses identity when Aggressive Mode shared secret authentication is used

Overview

The Internet Key Exchange (IKE) protocol discloses username information when Aggressive Mode is used for shared secret authentication.

I. Description

The Internet Key Exchange (IKE) protocol provides a negotiation mechanism that allows an initiator to establish an encrypted session with a responder. Many firewall and Virtual Private Network (VPN) products use IKE; check your product documentation to determine which modes and authentication methods are used by your product.

By design, the IKE protocol does not encrypt the identities of the initiator or responder when performing shared secret authentication in Aggressive Mode. Depending upon your site configuration and need for identity protection, this design choice may represent a vulnerability to your organization.

II. Impact

Devices that implement this protocol as specified will leak username information while negotiating IKE sessions. This information may be useful for conducting reconnaissance on networks containing an affected device.

III. Solution

Use an alternative mode and authentication method

The IKE protocol provides many options for both connection mode and authentication method; several combinations provide identity protection. For example, both Main Mode with shared secret authentication and Aggressive Mode with public key authentication provide identity protection.

Systems Affected

Vendor	Status	Date Notified
3Com	Unknown	18-Sep-2002
Alcatel	Unknown	18-Sep-2002
Apple Computer Inc.	Vulnerable	20-Sep-2002
AT&T	Unknown	18-Sep-2002
BSDI	Unknown	18-Sep-2002
Check Point	Vulnerable	8-Oct-2002
Cisco Systems Inc.	Unknown	18-Sep-2002
Compaq Computer Corporation	Unknown	8-Oct-2002
Computer Associates	Unknown	18-Sep-2002
Conectiva	Unknown	18-Sep-2002
Cray Inc.	Unknown	18-Sep-2002
Data General	Unknown	18-Sep-2002
Debian	Unknown	18-Sep-2002
F5 Networks	Not Vulnerable	8-Oct-2002
FreeBSD	Not Vulnerable	17-Oct-2002
Fujitsu	Not Vulnerable	18-Sep-2002
Guardian Digital Inc.	Not Vulnerable	2-Oct-2002
Hewlett-Packard Company	Unknown	8-Oct-2002
IBM	Unknown	18-Sep-2002
Intel	Unknown	18-Sep-2002
Juniper Networks	Unknown	18-Sep-2002
KAME Project	Vulnerable	15-Oct-2002
Lachman	Unknown	18-Sep-2002
Lotus Software	Unknown	18-Sep-2002
Lucent Technologies	Unknown	18-Sep-2002
MandrakeSoft	Unknown	18-Sep-2002
Microsoft Corporation	Not Vulnerable	30-Sep-2002
MontaVista Software	Not Vulnerable	20-Sep-2002
Multinet	Unknown	18-Sep-2002
NEC Corporation	Unknown	8-Oct-2002
NetBSD	Vulnerable	17-Oct-2002
Network Appliance	Not Vulnerable	20-Sep-2002
Nortel Networks	Unknown	18-Sep-2002
OpenBSD	Unknown	18-Sep-2002
Openwall GNU/*/Linux	Unknown	18-Sep-2002
Oracle Corporation	Unknown	18-Sep-2002
Red Hat Inc.	Unknown	18-Sep-2002
Sequent	Unknown	18-Sep-2002
SGI	Unknown	18-Sep-2002
Sony Corporation	Unknown	18-Sep-2002
Sun Microsystems Inc.	Not Vulnerable	20-Sep-2002
SuSE Inc.	Not Vulnerable	20-Sep-2002
The SCO Group (SCO Linux)	Unknown	18-Sep-2002
The SCO Group (SCO UnixWare)	Unknown	18-Sep-2002
Unisphere Networks	Unknown	18-Sep-2002
Unisys	Unknown	18-Sep-2002
Wind River Systems Inc.	Unknown	18-Sep-2002
Xerox Corporation	Not Vulnerable	4-Apr-2003

References

http://www.ietf.org/rfc/rfc2409.txt
http://www.checkpoint.com/techsupport/alerts/ike.html
http://www.nta-monitor.com/news/checkpoint.htm
http://www.dsinet.org/?id=2873
http://www.netsys.com/cgi-bin/displaynews?a=382
http://www.securiteam.com/securitynews/5TP040U8AW.html
http://online.securityfocus.com/news/603
http://online.securityfocus.com/archive/1/290202/2002-09-01/2002-09-07/0
http://packetstorm.linuxsecurity.com/advisories/misc/checkpoint.ike.txt

Credit

The CERT/CC thanks Roy Hills for reporting this issue.

This document was written by Jeffrey P. Lanza.

Other Information

Date Public:	2002-09-03
Date First Published:	2002-09-12
Date Last Updated:	2003-04-04
CERT Advisory:
CVE-ID(s):
NVD-ID(s):
US-CERT Technical Alerts:
Metric:	0.65
Document Revision:	23

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader