Debian Bug report logs - #385894
CVE-2006-4436: replay protection bypass vulnerability in isakmpd

version graph

Package: isakmpd; Maintainer for isakmpd is Jochen Friedrich <jochen@scram.de>; Source for isakmpd is src:isakmpd.

Reported by: Stefan Fritsch <sf@sfritsch.de>

Date: Sun, 3 Sep 2006 20:33:15 UTC

Severity: grave

Tags: patch, security

Fixed in version isakmpd/20041012-4

Done: Jochen Friedrich <jochen@scram.de>

Bug is archived. No further changes may be made.

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to debian-bugs-dist@lists.debian.org, Debian Security Team <team@security.debian.org>, Jochen Friedrich <jochen@scram.de>:
Bug#385894; Package isakmpd. Full text and rfc822 format available.

Acknowledgement sent to Stefan Fritsch <sf@sfritsch.de>:
New Bug report received and forwarded. Copy sent to Debian Security Team <team@security.debian.org>, Jochen Friedrich <jochen@scram.de>. Full text and rfc822 format available.

Message #5 received at submit@bugs.debian.org (full text, mbox):

From: Stefan Fritsch <sf@sfritsch.de>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: CVE-2006-4436: replay protection bypass vulnerability in isakmpd
Date: Sun, 03 Sep 2006 22:00:55 +0200
Package: isakmpd
Severity: grave
Tags: security patch
Justification: user security hole

A vulnerability has been found in isakmpd:

isakmpd in OpenBSD 3.8, 3.9, and possibly earlier versions, creates
Security Associations (SA) with a replay window of size 0 when isakmpd
acts as a responder during SA negotiation, which allows remote
attackers to replay IPSec packets and bypass the replay protection.

A patch is available at 
http://www.openbsd.org/errata.html#isakmpd



Reply sent to Jochen Friedrich <jochen@scram.de>:
You have taken responsibility. Full text and rfc822 format available.

Notification sent to Stefan Fritsch <sf@sfritsch.de>:
Bug acknowledged by developer. Full text and rfc822 format available.

Message #10 received at 385894-close@bugs.debian.org (full text, mbox):

From: Jochen Friedrich <jochen@scram.de>
To: 385894-close@bugs.debian.org
Subject: Bug#385894: fixed in isakmpd 20041012-4
Date: Wed, 06 Sep 2006 04:17:09 -0700
Source: isakmpd
Source-Version: 20041012-4

We believe that the bug you reported is fixed in the latest version of
isakmpd, which is due to be installed in the Debian FTP archive:

isakmpd_20041012-4.diff.gz
  to pool/main/i/isakmpd/isakmpd_20041012-4.diff.gz
isakmpd_20041012-4.dsc
  to pool/main/i/isakmpd/isakmpd_20041012-4.dsc
isakmpd_20041012-4_sparc.deb
  to pool/main/i/isakmpd/isakmpd_20041012-4_sparc.deb



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 385894@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Jochen Friedrich <jochen@scram.de> (supplier of updated isakmpd package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Mon,  4 Sep 2006 18:41:00 +0200
Source: isakmpd
Binary: isakmpd
Architecture: source sparc
Version: 20041012-4
Distribution: unstable
Urgency: high
Maintainer: Jochen Friedrich <jochen@scram.de>
Changed-By: Jochen Friedrich <jochen@scram.de>
Description: 
 isakmpd    - The Internet Key Exchange protocol openbsd implementation
Closes: 385894
Changes: 
 isakmpd (20041012-4) unstable; urgency=high
 .
   * Fix replay protection (CVE-2006-4436)
     Thanks to Stefan Fritsch <sf@fritsch.de> (Closes: #385894)
Files: 
 7bc5eeb8ea57cd6823369ba2a7176551 936 net optional isakmpd_20041012-4.dsc
 3256d8ef06f5e26649651760c0750726 32679 net optional isakmpd_20041012-4.diff.gz
 62b984202356fbc3a9b66204cf5e47f0 608678 net optional isakmpd_20041012-4_sparc.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)

iQEVAwUBRP6sIsP9a9GOLSE6AQLHIggAh0t0m/f7S45sJcc9UdWisC5F+oZ3e/dW
H2NeS1NH8RUaqnYrchPr597ZMh0wfdG1iOmfwAylurIxZ+v6YmhZH9w99Co/yEup
UxDRUQ4YSlRXNzbDVK1PgYvw/MjJn8LUju9ZG+8zzZkFWI3jzZXLSIdppTOWwLGf
8Q7aijQUWkGC/1CNBkJNdMnydsLTKl4GWxFAkbmOYfdiLS/kBG/LMmoI8oqTgNXF
6XPhVXPztJvoZE2aVSpGKPYZXD31sODpYbKEnw0NZPUz3jSs98Q2TpxVxSfGtGPq
JQecMb6pzPCNjY4MXf/zh6t8Su1CXnkVq/4Vmrp9g9iXUT/wlZK2xw==
=p45U
-----END PGP SIGNATURE-----




Bug archived. Request was from Debbugs Internal Request <owner@bugs.debian.org> to internal_control@bugs.debian.org. (Wed, 27 Jun 2007 06:05:17 GMT) Full text and rfc822 format available.

Send a report that this bug log contains spam.


Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Thu Apr 17 12:58:17 2014; Machine Name: buxtehude.debian.org

Debian Bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.