oss-sec mailing list archives

Re: CVE Request (ipsec-tools again)

From: "Steven M. Christey" <coley () linus mitre org>
Date: Tue, 12 Aug 2008 20:32:06 -0400 (EDT)


======================================================
Name: CVE-2008-3652
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3652
Reference: MLIST:[ipsec-tools-devel] 20080811 [PATCH] Track and delete orphaned ph1s
Reference: 
URL:http://sourceforge.net/mailarchive/forum.php?thread_name=48a0c7a0.qPeWZAE0PY8bDDq%2B%25olel%40ans.pl&forum_name=ipsec-tools-devel

src/racoon/handler.c in racoon in ipsec-tools does not remove an
"orphaned ph1" (phase 1) handle when it has been initiated remotely,
which allows remote attackers to cause a denial of service (resource
consumption).

Current thread:

CVE Request (ipsec-tools again) Josh Bressers (Aug 12)
- Re: CVE Request (ipsec-tools again) Steven M. Christey (Aug 12)