Vulnerability CVE-2005-3671
Published: 2005-11-18   Modified: 2012-02-12

Description:
The Internet Key Exchange version 1 (IKEv1) implementation in Openswan 2 (openswan-2) before 2.4.4, and freeswan in SUSE LINUX 9.1 before 2.04_1.5.4-1.23, allow remote attackers to cause a denial of service via (1) a crafted packet using 3DES with an invalid key length, or (2) unspecified inputs when Aggressive Mode is enabled and the PSK is known, as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1.

Type:

CWE-Other

CVSS2 => (AV:N/AC:L/Au:N/C:N/I:N/A:C)

CVSS Base Score
Impact Subscore
Exploitability Subscore
7.8/10
6.9/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
None
None
Complete
Affected software
Xelerance -> Openswan 
Openswan -> Openswan 
Frees wan -> Frees wan 

 References:
http://archives.neohapsis.com/archives/bugtraq/2005-12/0138.html
http://archives.neohapsis.com/archives/bugtraq/2005-12/0161.html
http://jvn.jp/niscc/NISCC-273756/index.html
http://securitytracker.com/id?1015214
http://www.ee.oulu.fi/research/ouspg/protos/testing/c09/isakmp/
http://www.gentoo.org/security/en/glsa/glsa-200512-04.xml
http://www.kb.cert.org/vuls/id/226364
http://www.niscc.gov.uk/niscc/docs/re-20051114-01014.pdf?lang=en
http://www.novell.com/linux/security/advisories/2005_70_ipsec.html
http://www.openswan.org/niscc2/
http://www.redhat.com/archives/fedora-announce-list/2005-November/msg00057.html
http://www.redhat.com/archives/fedora-announce-list/2005-November/msg00058.html
http://www.securityfocus.com/bid/15416
Copyright 2024, cxsecurity.com

 

Back to Top