CVE-2006-4436: replay protection bypass vulnerability in isakmpd

Debian Bug report logs - #385894
CVE-2006-4436: replay protection bypass vulnerability in isakmpd

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Stefan Fritsch <sf@sfritsch.de>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: CVE-2006-4436: replay protection bypass vulnerability in isakmpd

Date: Sun, 03 Sep 2006 22:00:55 +0200

Package: isakmpd
Severity: grave
Tags: security patch
Justification: user security hole

A vulnerability has been found in isakmpd:

isakmpd in OpenBSD 3.8, 3.9, and possibly earlier versions, creates
Security Associations (SA) with a replay window of size 0 when isakmpd
acts as a responder during SA negotiation, which allows remote
attackers to replay IPSec packets and bypass the replay protection.

A patch is available at 
http://www.openbsd.org/errata.html#isakmpd

Message #10 received at 385894-close@bugs.debian.org (full text, mbox, reply):

From: Jochen Friedrich <jochen@scram.de>

To: 385894-close@bugs.debian.org

Subject: Bug#385894: fixed in isakmpd 20041012-4

Date: Wed, 06 Sep 2006 04:17:09 -0700

Source: isakmpd
Source-Version: 20041012-4

We believe that the bug you reported is fixed in the latest version of
isakmpd, which is due to be installed in the Debian FTP archive:

isakmpd_20041012-4.diff.gz
  to pool/main/i/isakmpd/isakmpd_20041012-4.diff.gz
isakmpd_20041012-4.dsc
  to pool/main/i/isakmpd/isakmpd_20041012-4.dsc
isakmpd_20041012-4_sparc.deb
  to pool/main/i/isakmpd/isakmpd_20041012-4_sparc.deb



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 385894@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Jochen Friedrich <jochen@scram.de> (supplier of updated isakmpd package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Mon,  4 Sep 2006 18:41:00 +0200
Source: isakmpd
Binary: isakmpd
Architecture: source sparc
Version: 20041012-4
Distribution: unstable
Urgency: high
Maintainer: Jochen Friedrich <jochen@scram.de>
Changed-By: Jochen Friedrich <jochen@scram.de>
Description: 
 isakmpd    - The Internet Key Exchange protocol openbsd implementation
Closes: 385894
Changes: 
 isakmpd (20041012-4) unstable; urgency=high
 .
   * Fix replay protection (CVE-2006-4436)
     Thanks to Stefan Fritsch <sf@fritsch.de> (Closes: #385894)
Files: 
 7bc5eeb8ea57cd6823369ba2a7176551 936 net optional isakmpd_20041012-4.dsc
 3256d8ef06f5e26649651760c0750726 32679 net optional isakmpd_20041012-4.diff.gz
 62b984202356fbc3a9b66204cf5e47f0 608678 net optional isakmpd_20041012-4_sparc.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)

iQEVAwUBRP6sIsP9a9GOLSE6AQLHIggAh0t0m/f7S45sJcc9UdWisC5F+oZ3e/dW
H2NeS1NH8RUaqnYrchPr597ZMh0wfdG1iOmfwAylurIxZ+v6YmhZH9w99Co/yEup
UxDRUQ4YSlRXNzbDVK1PgYvw/MjJn8LUju9ZG+8zzZkFWI3jzZXLSIdppTOWwLGf
8Q7aijQUWkGC/1CNBkJNdMnydsLTKl4GWxFAkbmOYfdiLS/kBG/LMmoI8oqTgNXF
6XPhVXPztJvoZE2aVSpGKPYZXD31sODpYbKEnw0NZPUz3jSs98Q2TpxVxSfGtGPq
JQecMb6pzPCNjY4MXf/zh6t8Su1CXnkVq/4Vmrp9g9iXUT/wlZK2xw==
=p45U
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.