Re: CVE Request: IKEv1 protocol is vulnerable to DoS amplification attack

[Paul Wouters <pwouters () redhat com>]

On 07/07/2016 07:27 PM, Seaman, Chad wrote:
> Hi All,
>
> I’m Chad Seaman @ Akamai, the researcher who found, researched, and wrote the paper on the IKEv1 and IKEv2 flaws that 
> could lead to amplification attacks.
>
> The opening e-mail states that IKEv2 is not believed to be affected, I can confirm that in some cases some 
> implementations are indeed affected.
>
> There was some doubts about IKEv2 being affected and I was contacted by a Cisco engineer as well as one of the RFC 
> authors, we constructed multiple IKEv2
> probe payloads and did a series of secondary scans that specifically targeted IKEv2 hosts to confirm these results.
>
> Where hosts should respond once based on IKEv2 RFC specs, hundreds of thousands reply multiple times, roughly 110,000 
> reply 21 times or more per single
> probe, some of the worst offenders responded thousands of times.

Are you sure those replies did not come from IKEv1 servers that do not implement IKEv2 ? A bunch of implementations 
just copy the incoming header
to construct the outgoing header. You can detect this by sending an bogus IKEv3 packet and see if they reply the same 
to that.

Can you confirm your test actually got a valid IKE_INIT reply that was re-send multiple times? If so, can you detect 
the vendor behind it? I can probably help
fingerprint that to determine.

Paul