racoon remote denial of service vulnerability (IKE Generic Payload Header)
2003-12-03T00:00:00
ID 40FCF20F-8891-11D8-90D1-0020ED76EF5A Type freebsd Reporter FreeBSD Modified 2004-04-14T00:00:00
Description
When racoon receives an IKE message with an incorrectly
constructed Generic Payload Header, it may behave erratically,
going into a tight loop and dropping connections.
{"cve": [{"lastseen": "2017-07-11T11:14:25", "bulletinFamily": "NVD", "description": "racoon before 20040407b allows remote attackers to cause a denial of service (infinite loop and dropped connections) via an IKE message with a malformed Generic Payload Header containing invalid (1) \"Security Association Next Payload\" and (2) \"RESERVED\" fields.", "modified": "2017-07-10T21:30:07", "published": "2004-06-14T00:00:00", "id": "CVE-2004-0392", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2004-0392", "title": "CVE-2004-0392", "type": "cve", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}], "osvdb": [{"lastseen": "2017-04-28T13:20:00", "bulletinFamily": "software", "description": "## Vulnerability Description\nRacoon contains a flaw that may allow a remote denial of service. The issue is triggered when an IKE message is received with a malformed Generic Payload Header containing invalid SANP and \"Reserved\" fields. The attack causes an infinite loop and drops connections, resulting in loss of availability for the service.\n## Solution Description\nUpgrade to version 20040407a or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.\n## Short Description\nRacoon contains a flaw that may allow a remote denial of service. The issue is triggered when an IKE message is received with a malformed Generic Payload Header containing invalid SANP and \"Reserved\" fields. The attack causes an infinite loop and drops connections, resulting in loss of availability for the service.\n## References:\n[Secunia Advisory ID:11411](https://secuniaresearch.flexerasoftware.com/advisories/11411/)\n[Secunia Advisory ID:14178](https://secuniaresearch.flexerasoftware.com/advisories/14178/)\nOther Advisory URL: http://www.vuxml.org/freebsd/40fcf20f-8891-11d8-90d1-0020ed76ef5a.html \nOther Advisory URL: http://orange.kame.net/dev/query-pr.cgi?pr=555\nOther Advisory URL: ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.10/SCOSA-2005.10.txt\nMail List Post: http://archives.neohapsis.com/archives/secunia/2004-q2/0278.html\nISS X-Force ID: 15893\nGeneric Informational URL: http://www.computerworld.dk/sikkerhed/default.asp?Mode=2&AutoArticleID=18131\n[CVE-2004-0392](https://vulners.com/cve/CVE-2004-0392)\n", "modified": "2004-05-06T03:53:17", "published": "2004-05-06T03:53:17", "href": "https://vulners.com/osvdb/OSVDB:5893", "id": "OSVDB:5893", "type": "osvdb", "title": "KAME Racoon IKE Header DoS", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}], "openvas": [{"lastseen": "2017-07-02T21:10:22", "bulletinFamily": "scanner", "description": "The remote host is missing an update to the system\nas announced in the referenced advisory.", "modified": "2016-09-28T00:00:00", "published": "2008-09-04T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=52482", "id": "OPENVAS:52482", "title": "FreeBSD Ports: racoon", "type": "openvas", "sourceData": "#\n#VID 40fcf20f-8891-11d8-90d1-0020ed76ef5a\n# OpenVAS Vulnerability Test\n# $\n# Description: Auto generated from vuxml or freebsd advisories\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2008 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisories, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"The following package is affected: racoon\n\nCVE-2004-0392\nracoon before 20040407b allows remote attackers to cause a denial of\nservice (infinite loop and dropped connections) via an IKE message\nwith a malformed Generic Payload Header containing invalid (1)\n'Security Association Next Payload' and (2) 'RESERVED' fields.\";\ntag_solution = \"Update your system with the appropriate patches or\nsoftware upgrades.\n\nhttp://orange.kame.net/dev/query-pr.cgi?pr=555\nhttp://www.vuxml.org/freebsd/40fcf20f-8891-11d8-90d1-0020ed76ef5a.html\";\ntag_summary = \"The remote host is missing an update to the system\nas announced in the referenced advisory.\";\n\n\nif(description)\n{\n script_id(52482);\n script_version(\"$Revision: 4164 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2016-09-28 09:03:16 +0200 (Wed, 28 Sep 2016) $\");\n script_tag(name:\"creation_date\", value:\"2008-09-04 20:41:11 +0200 (Thu, 04 Sep 2008)\");\n script_cve_id(\"CVE-2004-0392\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_name(\"FreeBSD Ports: racoon\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"FreeBSD Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/freebsdrel\", \"login/SSH/success\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-bsd.inc\");\n\ntxt = \"\";\nvuln = 0;\nbver = portver(pkg:\"racoon\");\nif(!isnull(bver) && revcomp(a:bver, b:\"20040407b\")<0) {\n txt += 'Package racoon version ' + bver + ' is installed which is known to be vulnerable.\\n';\n vuln = 1;\n}\n\nif(vuln) {\n security_message(data:string(txt));\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}], "nessus": [{"lastseen": "2019-02-21T01:08:39", "bulletinFamily": "scanner", "description": "When racoon receives an IKE message with an incorrectly constructed Generic Payload Header, it may behave erratically, going into a tight loop and dropping connections.", "modified": "2018-11-10T00:00:00", "id": "FREEBSD_PKG_40FCF20F889111D890D10020ED76EF5A.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=18917", "published": "2005-07-13T00:00:00", "title": "FreeBSD : racoon remote denial of service vulnerability (IKE Generic Payload Header) (40fcf20f-8891-11d8-90d1-0020ed76ef5a)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the FreeBSD VuXML database :\n#\n# Copyright 2003-2018 Jacques Vidrine and contributors\n#\n# Redistribution and use in source (VuXML) and 'compiled' forms (SGML,\n# HTML, PDF, PostScript, RTF and so forth) with or without modification,\n# are permitted provided that the following conditions are met:\n# 1. Redistributions of source code (VuXML) must retain the above\n# copyright notice, this list of conditions and the following\n# disclaimer as the first lines of this file unmodified.\n# 2. Redistributions in compiled form (transformed to other DTDs,\n# published online in any format, converted to PDF, PostScript,\n# RTF and other formats) must reproduce the above copyright\n# notice, this list of conditions and the following disclaimer\n# in the documentation and/or other materials provided with the\n# distribution.\n# \n# THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS \"AS IS\"\n# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,\n# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR\n# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS\n# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,\n# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT\n# OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR\n# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,\n# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE\n# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,\n# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(18917);\n script_version(\"1.12\");\n script_cvs_date(\"Date: 2018/11/10 11:49:39\");\n\n script_cve_id(\"CVE-2004-0392\");\n\n script_name(english:\"FreeBSD : racoon remote denial of service vulnerability (IKE Generic Payload Header) (40fcf20f-8891-11d8-90d1-0020ed76ef5a)\");\n script_summary(english:\"Checks for updated package in pkg_info output\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote FreeBSD host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"When racoon receives an IKE message with an incorrectly constructed\nGeneric Payload Header, it may behave erratically, going into a tight\nloop and dropping connections.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://orange.kame.net/dev/query-pr.cgi?pr=555\"\n );\n # https://vuxml.freebsd.org/freebsd/40fcf20f-8891-11d8-90d1-0020ed76ef5a.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?b2c8d170\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:racoon\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:freebsd:freebsd\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2003/12/03\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2004/04/07\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2005/07/13\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2005-2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"FreeBSD Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/FreeBSD/release\", \"Host/FreeBSD/pkg_info\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"freebsd_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/FreeBSD/release\")) audit(AUDIT_OS_NOT, \"FreeBSD\");\nif (!get_kb_item(\"Host/FreeBSD/pkg_info\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (pkg_test(save_report:TRUE, pkg:\"racoon<20040407b\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:pkg_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2019-02-21T01:07:54", "bulletinFamily": "scanner", "description": "The remote host is missing Security Update 2004-05-03.\nThis security update includes updates for AFP Server, CoreFoundation, and IPSec.\n\nIt also includes Security Update 2004-04-05, which includes updates for CUPS, libxml2, Mail, and OpenSSL.\n\nFor Mac OS X 10.2.8, it also includes updates for Apache 1.3, cd9660.util, Classic, CUPS, Directory Services, DiskArbitration, fetchmail, fs_usage, gm4, groff, Mail, OpenSSL, Personal File Sharing, PPP, rsync, Safari, System Configuration, System Initialization, and zlib.\n\nThis update fixes various issues which may allow an attacker to execute arbitrary code on the remote host.", "modified": "2018-08-10T00:00:00", "id": "MACOSX_SECUPD20040503.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=12518", "published": "2004-07-06T00:00:00", "title": "Mac OS X Multiple Vulnerabilities (Security Update 2004-05-03)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\n# better URL in solution, preserving old:\n#http://www.apple.com/downloads/macosx/apple/securityupdate__2004-05-03_(10_3_3_Client).html\n#http://www.apple.com/downloads/macosx/apple/securityupdate_2004-05-03_(10_2_8_Client).html\n#http://www.apple.com/downloads/macosx/apple/securityupdate_2004-05-03_(10_2_8_Server).html\n#http://www.apple.com/downloads/macosx/apple/securityupdate.html\n \nif ( ! defined_func(\"bn_random\") ) exit(0);\n\ninclude(\"compat.inc\");\n\nif(description)\n{\n script_id(12518);\n script_version (\"1.17\");\n script_cve_id(\n \"CVE-2004-0020\",\n \"CVE-2004-0113\",\n \"CVE-2004-0155\",\n \"CVE-2004-0174\",\n \"CVE-2004-0392\",\n \"CVE-2004-0403\", \n \"CVE-2004-0428\",\n \"CVE-2004-0430\"\n );\n\n script_name(english:\"Mac OS X Multiple Vulnerabilities (Security Update 2004-05-03)\");\n script_summary(english:\"Check for Security Update 2004-05-03\");\n \n script_set_attribute(\n attribute:\"synopsis\",\n value:\n\"The remote host is missing a Mac OS X update that fixes a security\nissue.\" );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The remote host is missing Security Update 2004-05-03.\nThis security update includes updates for AFP Server, CoreFoundation,\nand IPSec.\n\nIt also includes Security Update 2004-04-05, which includes updates\nfor CUPS, libxml2, Mail, and OpenSSL.\n\nFor Mac OS X 10.2.8, it also includes updates for Apache 1.3,\ncd9660.util, Classic, CUPS, Directory Services, DiskArbitration,\nfetchmail, fs_usage, gm4, groff, Mail, OpenSSL, Personal File Sharing,\nPPP, rsync, Safari, System Configuration, System Initialization, and\nzlib.\n\nThis update fixes various issues which may allow an attacker to\nexecute arbitrary code on the remote host.\" );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://support.apple.com/kb/HT1646\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://lists.apple.com/archives/security-announce/2004/May/msg00000.html\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Install Security Update 2004-05-03.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'AppleFileServer LoginExt PathName Overflow');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n script_set_attribute(attribute:\"plugin_publication_date\", value: \"2004/07/06\");\n script_set_attribute(attribute:\"vuln_publication_date\", value: \"2003/02/24\");\n script_set_attribute(attribute:\"patch_publication_date\", value: \"2004/05/03\");\n script_cvs_date(\"Date: 2018/08/10 18:07:07\");\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:apple:mac_os_x\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"MacOS X Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2004-2018 Tenable Network Security, Inc.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/MacOSX/packages\");\n exit(0);\n}\n\n\npackages = get_kb_item(\"Host/MacOSX/packages\");\nif ( ! packages ) exit(0);\n\nuname = get_kb_item(\"Host/uname\");\nos = get_kb_item(\"Host/MacOSX/Version\");\nif ( egrep(pattern:\"Mac OS X 10\\.3.* Server\", string:os) ) exit(0);\n\n# MacOS X 10.2.8 and 10.3.3 only\nif ( egrep(pattern:\"Darwin.* (6\\.8\\.|7\\.3\\.)\", string:uname) )\n{\n if ( ! egrep(pattern:\"^SecUpd2004-05-03\", string:packages) ) security_hole(0);\n else {\n\tset_kb_item(name:\"CVE-2004-0174\", value:TRUE);\n\tset_kb_item(name:\"CVE-2003-0020\", value:TRUE);\n\tset_kb_item(name:\"CVE-2004-0079\", value:TRUE);\n\tset_kb_item(name:\"CVE-2004-0081\", value:TRUE);\n\tset_kb_item(name:\"CVE-2004-0112\", value:TRUE);\n\t}\n}\n", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}]}
