CVSS: 5.0EPSS: 18%CPEs: 35EXPL: 0CVE-2009-1632 – ipsec-tools: multiple memory leaks fixed in 0.7.2
https://notcve.org/view.php?id=CVE-2009-1632
Multiple memory leaks in Ipsec-tools before 0.7.2 allow remote attackers to cause a denial of service (memory consumption) via vectors involving (1) signature verification during user authentication with X.509 certificates, related to the eay_check_x509sign function in src/racoon/crypto_openssl.c; and (2) the NAT-Traversal (aka NAT-T) keepalive implementation, related to src/racoon/nattraversal.c. Múltiples fugas de memoria en Ipsec-tools versiones anteriores a v0.7.2 permite a atacantes remotos provocar una denegación de servicio (consumo de memoria) a través de vectores envueltos (1) en la verificación de firma durante la autenticación de usuarios con certificados X.509, relacionado con la función eay_check_x509sign en src/racoon/crypto_openssl.c; y (2) la implementación NAT-Traversal (aka NAT-T) keepalive, relacionado con src/racoon/nattraversal.c. • http://cvsweb.netbsd.org/bsdweb.cgi/src/crypto/dist/ipsec-tools/src/racoon/crypto_openssl.c http://cvsweb.netbsd.org/bsdweb.cgi/src/crypto/dist/ipsec-tools/src/racoon/crypto_openssl.c.diff?r1=1.11.6.4&r2=1.11.6.5&f=h http://cvsweb.netbsd.org/bsdweb.cgi/src/crypto/dist/ipsec-tools/src/racoon/nattraversal.c http://cvsweb.netbsd.org/bsdweb.cgi/src/crypto/dist/ipsec-tools/src/racoon/nattraversal.c.diff?r1=1.6&r2=1.6.6.1&f=h http://kb.juniper.net/InfoCenter& • CWE-399: Resource Management Errors CWE-401: Missing Release of Memory after Effective Lifetime •
CVSS: 5.0EPSS: 13%CPEs: 26EXPL: 2CVE-2009-1574 – IPsec-Tools < 0.7.2 (racoon frag-isakmp) - Multiple Remote Denial of Service Vulnerabilities (PoC)
https://notcve.org/view.php?id=CVE-2009-1574
racoon/isakmp_frag.c in ipsec-tools before 0.7.2 allows remote attackers to cause a denial of service (crash) via crafted fragmented packets without a payload, which triggers a NULL pointer dereference. racoon/isakmp_frag.c en ipsec-tools anterior a v0.7.2, permite a atacantes remotos provocar una denegación de servicio (caída) a través de paquetes fragmentados sin carga, que lanza un deferencia a puntero NULL. • https://www.exploit-db.com/exploits/8669 http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html http://lists.apple.com/archives/security-announce/2010//Dec/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html http://secunia.com/advisories/35113 http://secunia.com/advisories/35153 http://secunia.com/advisories/35159 http://secunia.com/advisories/35212 http://secunia& • CWE-476: NULL Pointer Dereference •
CVSS: 4.3EPSS: 16%CPEs: 1EXPL: 0CVE-2007-1841 – ipsec-tools racoon DoS
https://notcve.org/view.php?id=CVE-2007-1841
The isakmp_info_recv function in src/racoon/isakmp_inf.c in racoon in Ipsec-tools before 0.6.7 allows remote attackers to cause a denial of service (tunnel crash) via crafted (1) DELETE (ISAKMP_NPTYPE_D) and (2) NOTIFY (ISAKMP_NPTYPE_N) messages. La función isakmp_info_recv en src/racoon/isakmp_inf.c en racoon de Ipsec-tools anterior a 0.6.7 permite a atacantes remotos provocar una denegación de servicio (caída de túnel) mediante mensajes manipulados (1) DELETE (ISAKMP_NPTYPE_D) y (2) NOTIFY (ISAKMP_NPTYPE_N). • http://secunia.com/advisories/24815 http://secunia.com/advisories/24826 http://secunia.com/advisories/24833 http://secunia.com/advisories/25072 http://secunia.com/advisories/25142 http://secunia.com/advisories/25322 http://secunia.com/advisories/25560 http://security.gentoo.org/glsa/glsa-200705-09.xml http://sourceforge.net/mailarchive/message.php?msg_name=20070406123739.GA1546%40zen.inc http://sourceforge.net/project/shownotes.php?release_id=499192&group_id=74601 http://www.debian. •
CVSS: 10.0EPSS: 93%CPEs: 17EXPL: 0CVE-2004-0607
https://notcve.org/view.php?id=CVE-2004-0607
The eay_check_x509cert function in KAME Racoon successfully verifies certificates even when OpenSSL validation fails, which could allow remote attackers to bypass authentication. La función eay_check_x509cert en KAME Racoon verifica como buenos certificados incluso cuando la validación OpenSLL falla, lo que podría permitir a atacantes remotos saltarse la autenticación. • ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.10/SCOSA-2005.10.txt http://marc.info/?l=bugtraq&m=108726102304507&w=2 http://marc.info/?l=bugtraq&m=108731967126033&w=2 http://secunia.com/advisories/11863 http://secunia.com/advisories/11877 http://security.gentoo.org/glsa/glsa-200406-17.xml http://securitytracker.com/id?1010495 http://sourceforge.net/project/shownotes.php?release_id=245982 http://www.osvdb.org/7113 http://www.redhat.com/support/errata/RHSA-2 •