CVE-2004-0607

2004-12-0605:00:00

NVD-CWE-Other

[email protected]

web.nvd.nist.gov

cve-2004-0607

kame racoon

openssl

authentication bypass

remote attackers

6.4 Medium

AI Score

Confidence

Low

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.933 High

EPSS

Percentile

99.1%

JSON

The eay_check_x509cert function in KAME Racoon successfully verifies certificates even when OpenSSL validation fails, which could allow remote attackers to bypass authentication.

CPENameOperatorVersion
ipsec-tools:ipsec-toolsipsec-toolseq0.3_rc4
ipsec-tools:ipsec-toolsipsec-toolseq0.3_rc2
kame:racoonkame racooneq*
kame:racoonkame racooneq2004-04-05
ipsec-tools:ipsec-toolsipsec-toolseq0.3.2
ipsec-tools:ipsec-toolsipsec-toolseq0.3_rc5
kame:racoonkame racooneq2003-07-11
ipsec-tools:ipsec-toolsipsec-toolseq0.3.1
kame:racoonkame racooneq2004-05-03
ipsec-tools:ipsec-toolsipsec-toolseq0.3_rc1

CPE	Name	Operator	Version
ipsec-tools:ipsec-tools	ipsec-tools	eq	0.3_rc4
ipsec-tools:ipsec-tools	ipsec-tools	eq	0.3_rc2
kame:racoon	kame racoon	eq	*
kame:racoon	kame racoon	eq	2004-04-05
ipsec-tools:ipsec-tools	ipsec-tools	eq	0.3.2
ipsec-tools:ipsec-tools	ipsec-tools	eq	0.3_rc5
kame:racoon	kame racoon	eq	2003-07-11
ipsec-tools:ipsec-tools	ipsec-tools	eq	0.3.1
kame:racoon	kame racoon	eq	2004-05-03
ipsec-tools:ipsec-tools	ipsec-tools	eq	0.3_rc1