Bugtraq mailing list archives
Re: multiple payload handling flaws in isakmpd, again
From: Thomas Walpuski <thomas () thinknerd de>
Date: Thu, 1 Jan 2004 21:20:18 +0100
There is one important thing I forgot to mention. In isakmpd deleting an IPsec SA also means deleting the appropriate IPsec policy in almost any case. Take a look at pf_key_v2_delete_spi() in pf_key_v2.c. It calls pf_key_v2_disable_sa(), the policy eraser ;-), if the SA was not acquired through the kernel: if (!(sa->flags & SA_FLAG_REPLACED) && !(sa->flags & SA_FLAG_ONDEMAND)) pf_key_v2_disable_sa (sa, incoming); Now imagine an IPsec tunnel between two security gateways running isakmpd. Both gateways are attacked, IPsec SAs and policies get removed, ... Thomas Walpuski
Current thread:
- multiple payload handling flaws in isakmpd, again Thomas Walpuski (Jan 01)
- Re: multiple payload handling flaws in isakmpd, again Thomas Walpuski (Jan 01)