Debian Bug report logs - #385894
CVE-2006-4436: replay protection bypass vulnerability in isakmpd

version graph

Package: isakmpd; Maintainer for isakmpd is Jochen Friedrich <>; Source for isakmpd is src:isakmpd.

Reported by: Stefan Fritsch <>

Date: Sun, 3 Sep 2006 20:33:15 UTC

Severity: grave

Tags: patch, security

Fixed in version isakmpd/20041012-4

Done: Jochen Friedrich <>

Bug is archived. No further changes may be made.

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox

Report forwarded to, Debian Security Team <>, Jochen Friedrich <>:
Bug#385894; Package isakmpd. Full text and rfc822 format available.

Acknowledgement sent to Stefan Fritsch <>:
New Bug report received and forwarded. Copy sent to Debian Security Team <>, Jochen Friedrich <>. Full text and rfc822 format available.

Message #5 received at (full text, mbox):

From: Stefan Fritsch <>
To: Debian Bug Tracking System <>
Subject: CVE-2006-4436: replay protection bypass vulnerability in isakmpd
Date: Sun, 03 Sep 2006 22:00:55 +0200
Package: isakmpd
Severity: grave
Tags: security patch
Justification: user security hole

A vulnerability has been found in isakmpd:

isakmpd in OpenBSD 3.8, 3.9, and possibly earlier versions, creates
Security Associations (SA) with a replay window of size 0 when isakmpd
acts as a responder during SA negotiation, which allows remote
attackers to replay IPSec packets and bypass the replay protection.

A patch is available at

Reply sent to Jochen Friedrich <>:
You have taken responsibility. Full text and rfc822 format available.

Notification sent to Stefan Fritsch <>:
Bug acknowledged by developer. Full text and rfc822 format available.

Message #10 received at (full text, mbox):

From: Jochen Friedrich <>
Subject: Bug#385894: fixed in isakmpd 20041012-4
Date: Wed, 06 Sep 2006 04:17:09 -0700
Source: isakmpd
Source-Version: 20041012-4

We believe that the bug you reported is fixed in the latest version of
isakmpd, which is due to be installed in the Debian FTP archive:

  to pool/main/i/isakmpd/isakmpd_20041012-4.diff.gz
  to pool/main/i/isakmpd/isakmpd_20041012-4.dsc
  to pool/main/i/isakmpd/isakmpd_20041012-4_sparc.deb

A summary of the changes between this version and the previous one is

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
Jochen Friedrich <> (supplier of updated isakmpd package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing

Hash: SHA1

Format: 1.7
Date: Mon,  4 Sep 2006 18:41:00 +0200
Source: isakmpd
Binary: isakmpd
Architecture: source sparc
Version: 20041012-4
Distribution: unstable
Urgency: high
Maintainer: Jochen Friedrich <>
Changed-By: Jochen Friedrich <>
 isakmpd    - The Internet Key Exchange protocol openbsd implementation
Closes: 385894
 isakmpd (20041012-4) unstable; urgency=high
   * Fix replay protection (CVE-2006-4436)
     Thanks to Stefan Fritsch <> (Closes: #385894)
 7bc5eeb8ea57cd6823369ba2a7176551 936 net optional isakmpd_20041012-4.dsc
 3256d8ef06f5e26649651760c0750726 32679 net optional isakmpd_20041012-4.diff.gz
 62b984202356fbc3a9b66204cf5e47f0 608678 net optional isakmpd_20041012-4_sparc.deb

Version: GnuPG v1.4.5 (GNU/Linux)


Bug archived. Request was from Debbugs Internal Request <> to (Wed, 27 Jun 2007 06:05:17 GMT) Full text and rfc822 format available.

Send a report that this bug log contains spam.

Debian bug tracking system administrator <>. Last modified: Thu Apr 17 12:58:17 2014; Machine Name:

Debian Bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.