CVE-2018-5389

2018-09-0600:00:00

ubuntu.com

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.003

Percentile

70.1%

JSON

The Internet Key Exchange v1 main mode is vulnerable to offline dictionary
or brute force attacks. Reusing a key pair across different versions and
modes of IKE could lead to cross-protocol authentication bypasses. It is
well known, that the aggressive mode of IKEv1 PSK is vulnerable to offline
dictionary or brute force attacks. For the main mode, however, only an
online attack against PSK authentication was thought to be feasible. This
vulnerability could allow an attacker to recover a weak Pre-Shared Key or
enable the impersonation of a victim host or network.