Cisco ASA Software IKEv1 and IKEv2 Buffer Overflow Vulnerability (cisco-sa-20160210-asa-ike)

Cisco ASA Software is prone to a buffer overflow vulnerability. Copyright C 2016 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free softwar...

Cisco Adaptive Security Appliance (ASA) IKEv1 and IKEv2 contains a buffer overflow vulnerability

Overview Cisco Adaptive Security Appliance ASA Internet Key Exchange versions 1 and 2 IKEv1 and IKEv2 contains a buffer overflow vulnerability that may be leveraged to gain remote code execution. Description CWE-119: Improper Restriction of Operations within the Bound of a Memory Buffer -...

Cisco ASA Software IKEv1 and IKEv2 Buffer Overflow Vulnerability

A vulnerability in the Internet Key Exchange IKE version 1 v1 and IKE version 2 v2 code of Cisco ASA Software could allow an unauthenticated, remote attacker to cause a reload of the affected system or to remotely execute code. The vulnerability is due to a buffer overflow in the affected code...

Cisco IOS Software IKEv1 State Machine DoS (CSCuw08236)

According to its self-reported version, the Cisco IOS software running on the remote device is affected by a denial of service vulnerability in the Internet Key Exchange version 1 IKEv1 subsystem due to insufficient condition checks in the IKEv1 state machine. An unauthenticated, remote attacker...

SLOTH Collisions Attacks Against SHA-1, MD5 in TLS, IKE, SSH

If you’re hanging on to the theory that collision attacks against SHA-1 and MD5 aren’t yet practical, two researchers from INRIA, the French Institute for Research in Computer Science and Automation, have demonstrated new attacks that raise the urgency to move away from these broken cryptographic...

Cisco IOS and IOS XE Software IKEv1 State Machine Denial of Service Vulnerability

Cisco IOS is the interconnected Internet operating system used on most Cisco Systems routers and network switches. A security vulnerability exists in the IKEv1 state machine of Cisco IOS and Cisco IOS XE Software. An unauthenticated, remote attacker sending spoofed IKEv1 packets to the endpoint o...

CVE-2015-6429

The IKEv1 state machine in Cisco IOS 15.4 through 15.6 and IOS XE 3.15 through 3.17 allows remote attackers to cause a denial of service IPsec connection termination via a crafted IKEv1 packet to a tunnel endpoint, aka Bug ID CSCuw08236...

Design/Logic Flaw

The IKEv1 state machine in Cisco IOS 15.4 through 15.6 and IOS XE 3.15 through 3.17 allows remote attackers to cause a denial of service IPsec connection termination via a crafted IKEv1 packet to a tunnel endpoint, aka Bug ID CSCuw08236...

CVE-2015-6429

The IKEv1 state machine in Cisco IOS 15.4 through 15.6 and IOS XE 3.15 through 3.17 allows remote attackers to cause a denial of service IPsec connection termination via a crafted IKEv1 packet to a tunnel endpoint, aka Bug ID CSCuw08236...

Cisco IOS and IOS XE Software IKEv1 State Machine Denial of Service Vulnerability

A vulnerability in the Internet Key Exchange IKEv1 state machine of Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to tear down valid IPsec connections, resulting in a partial denial of service DoS condition. The vulnerability is due to insufficient condition...

Debian Security Advisory DSA 3398-1 (strongswan - security update)

Tobias Brunner found an authentication bypass vulnerability in strongSwan, an IKE/IPsec suite. Due to insufficient validation of its local state the server implementation of the EAP-MSCHAPv2 protocol in the eap-mschapv2 plugin can be tricked into successfully concluding the authentication without...

Fewer IPsec VPN Connections at Risk to Weak Diffie-Hellman

A challenge has been made against one of the conclusions in a potentially blockbuster academic paper on cryptographic weaknesses that may be the open door through which intelligence agencies are breaking encrypted connections. The paper, “Imperfect Forward Secrecy: How Diffie-Hellman Fails in...

CVE-2015-6327

The IKEv1 implementation in Cisco Adaptive Security Appliance ASA software 7.2 and 8.2 before 8.25.58, 8.3 and 8.4 before 8.47.29, 8.5 through 8.7 before 8.71.17, 9.0 before 9.04.37, 9.1 before 9.16.8, 9.2 before 9.24, and 9.3 before 9.33 allows remote attackers to cause a denial of service devic...

Code injection

The IKEv1 implementation in Cisco Adaptive Security Appliance ASA software 7.2 and 8.2 before 8.25.58, 8.3 and 8.4 before 8.47.29, 8.5 through 8.7 before 8.71.17, 9.0 before 9.04.37, 9.1 before 9.16.8, 9.2 before 9.24, and 9.3 before 9.33 allows remote attackers to cause a denial of service devic...

CVE-2015-6327

The IKEv1 implementation in Cisco Adaptive Security Appliance ASA software 7.2 and 8.2 before 8.25.58, 8.3 and 8.4 before 8.47.29, 8.5 through 8.7 before 8.71.17, 9.0 before 9.04.37, 9.1 before 9.16.8, 9.2 before 9.24, and 9.3 before 9.33 allows remote attackers to cause a denial of service devic...

CVE-2015-6327

CVE-2015-6327 affects Cisco ASA: the IKEv1 implementation mishandles ISAKMP UDP packets, enabling a remote attacker to trigger a denial of service (device reload). Affected ASA versions include 7.2; 8.2 up to 8.2(5.58); 8.3 and 8.4 up to 8.4(7.29); 8.5–8.7 up to 8.7(1.17); 9.0 up to 9.0(4.37); 9....

[SECURITY] Fedora 22 Update: strongswan-5.3.2-1.fc22

The strongSwan IPsec implementation supports both the IKEv1 and IKEv2 key exchange protocols in conjunction with the native NETKEY IPsec stack of the Linux kernel...

[SECURITY] Fedora 21 Update: strongswan-5.3.2-1.fc21

The strongSwan IPsec implementation supports both the IKEv1 and IKEv2 key exchange protocols in conjunction with the native NETKEY IPsec stack of the Linux kernel...

CVE-2015-3204

libreswan 3.9 through 3.12 allows remote attackers to cause a denial of service daemon restart via an IKEv1 packet with 1 unassigned bits set in the IPSEC DOI value or 2 the next payload value set to ISAKMPNEXTSAK...

CVE-2015-3204

libreswan 3.9 through 3.12 allows remote attackers to cause a denial of service daemon restart via an IKEv1 packet with 1 unassigned bits set in the IPSEC DOI value or 2 the next payload value set to ISAKMPNEXTSAK...