Vulnerabilities > CVE-2004-0155 - Unspecified vulnerability in Kame Racoon

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
low complexity
kame
nessus

Summary

The KAME IKE Daemon Racoon, when authenticating a peer during Phase 1, validates the X.509 certificate but does not verify the RSA signature authentication, which allows remote attackers to establish unauthorized IP connections or conduct man-in-the-middle attacks using a valid, trusted X.509 certificate.

Vulnerable Configurations

Part Description Count
Application
Kame
1

Nessus

  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_SECUPD20040503.NASL
    descriptionThe remote host is missing Security Update 2004-05-03. This security update includes updates for AFP Server, CoreFoundation, and IPSec. It also includes Security Update 2004-04-05, which includes updates for CUPS, libxml2, Mail, and OpenSSL. For Mac OS X 10.2.8, it also includes updates for Apache 1.3, cd9660.util, Classic, CUPS, Directory Services, DiskArbitration, fetchmail, fs_usage, gm4, groff, Mail, OpenSSL, Personal File Sharing, PPP, rsync, Safari, System Configuration, System Initialization, and zlib. This update fixes various issues which may allow an attacker to execute arbitrary code on the remote host.
    last seen2020-06-01
    modified2020-06-02
    plugin id12518
    published2004-07-06
    reporterThis script is Copyright (C) 2004-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/12518
    titleMac OS X Multiple Vulnerabilities (Security Update 2004-05-03)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    # better URL in solution, preserving old:
    #http://www.apple.com/downloads/macosx/apple/securityupdate__2004-05-03_(10_3_3_Client).html
    #http://www.apple.com/downloads/macosx/apple/securityupdate_2004-05-03_(10_2_8_Client).html
    #http://www.apple.com/downloads/macosx/apple/securityupdate_2004-05-03_(10_2_8_Server).html
    #http://www.apple.com/downloads/macosx/apple/securityupdate.html
                   
    if ( ! defined_func("bn_random") ) exit(0);
    
    include("compat.inc");
    
    if(description)
    {
     script_id(12518);
     script_version ("1.17");
     script_cve_id(
       "CVE-2004-0020",
       "CVE-2004-0113",
       "CVE-2004-0155",
       "CVE-2004-0174",
       "CVE-2004-0392",
       "CVE-2004-0403", 
       "CVE-2004-0428",
       "CVE-2004-0430"
     );
    
     script_name(english:"Mac OS X Multiple Vulnerabilities (Security Update 2004-05-03)");
     script_summary(english:"Check for Security Update 2004-05-03");
     
     script_set_attribute(
       attribute:"synopsis",
       value:
    "The remote host is missing a Mac OS X update that fixes a security
    issue." );
     script_set_attribute(
       attribute:"description", 
       value:
    "The remote host is missing Security Update 2004-05-03.
    This security update includes updates for AFP Server, CoreFoundation,
    and IPSec.
    
    It also includes Security Update 2004-04-05, which includes updates
    for CUPS, libxml2, Mail, and OpenSSL.
    
    For Mac OS X 10.2.8, it also includes updates for Apache 1.3,
    cd9660.util, Classic, CUPS, Directory Services, DiskArbitration,
    fetchmail, fs_usage, gm4, groff, Mail, OpenSSL, Personal File Sharing,
    PPP, rsync, Safari, System Configuration, System Initialization, and
    zlib.
    
    This update fixes various issues which may allow an attacker to
    execute arbitrary code on the remote host." );
     script_set_attribute(
       attribute:"see_also",
       value:"http://support.apple.com/kb/HT1646"
     );
     script_set_attribute(
       attribute:"see_also",
       value:"http://lists.apple.com/archives/security-announce/2004/May/msg00000.html"
     );
     script_set_attribute(
       attribute:"solution", 
       value:"Install Security Update 2004-05-03."
     );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
     script_set_attribute(attribute:"metasploit_name", value:'AppleFileServer LoginExt PathName Overflow');
     script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
     script_set_attribute(attribute:"plugin_publication_date", value: "2004/07/06");
     script_set_attribute(attribute:"vuln_publication_date", value: "2003/02/24");
     script_set_attribute(attribute:"patch_publication_date", value: "2004/05/03");
     script_cvs_date("Date: 2018/08/10 18:07:07");
     script_set_attribute(attribute:"plugin_type", value:"local");
     script_set_attribute(attribute:"cpe", value:"cpe:/o:apple:mac_os_x");
     script_end_attributes();
    
     script_category(ACT_GATHER_INFO);
     script_family(english:"MacOS X Local Security Checks");
    
     script_copyright(english:"This script is Copyright (C) 2004-2018 Tenable Network Security, Inc.");
    
     script_dependencies("ssh_get_info.nasl");
     script_require_keys("Host/MacOSX/packages");
     exit(0);
    }
    
    
    packages = get_kb_item("Host/MacOSX/packages");
    if ( ! packages ) exit(0);
    
    uname = get_kb_item("Host/uname");
    os    = get_kb_item("Host/MacOSX/Version");
    if ( egrep(pattern:"Mac OS X 10\.3.* Server", string:os) ) exit(0);
    
    # MacOS X 10.2.8 and 10.3.3 only
    if ( egrep(pattern:"Darwin.* (6\.8\.|7\.3\.)", string:uname) )
    {
      if ( ! egrep(pattern:"^SecUpd2004-05-03", string:packages) ) security_hole(0);
      else {
    	set_kb_item(name:"CVE-2004-0174", value:TRUE);
    	set_kb_item(name:"CVE-2003-0020", value:TRUE);
    	set_kb_item(name:"CVE-2004-0079", value:TRUE);
    	set_kb_item(name:"CVE-2004-0081", value:TRUE);
    	set_kb_item(name:"CVE-2004-0112", value:TRUE);
    	}
    }
    
  • NASL familyMandriva Local Security Checks
    NASL idMANDRAKE_MDKSA-2004-069.NASL
    descriptionA vulnerability in racoon prior to version 20040408a would allow a remote attacker to cause a DoS (memory consumption) via an ISAKMP packet with a large length field. Another vulnerability in racoon was discovered where, when using RSA signatures, racoon would validate the X.509 certificate but would not validate the signature. This can be exploited by an attacker sending a valid and trusted X.509 certificate and any private key. Using this, they could perform a man-in-the-middle attack and initiate an unauthorized connection. This has been fixed in ipsec-tools 0.3.3. The updated packages contain patches backported from 0.3.3 to correct the problem.
    last seen2020-06-01
    modified2020-06-02
    plugin id14168
    published2004-07-31
    reporterThis script is Copyright (C) 2004-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/14168
    titleMandrake Linux Security Advisory : ipsec-tools (MDKSA-2004:069)
    code
    #%NASL_MIN_LEVEL 80502
    
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Mandrake Linux Security Advisory MDKSA-2004:069. 
    # The text itself is copyright (C) Mandriva S.A.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(14168);
      script_version ("1.19");
      script_cvs_date("Date: 2019/08/02 13:32:47");
    
      script_cve_id("CVE-2004-0155", "CVE-2004-0403");
      script_xref(name:"MDKSA", value:"2004:069");
    
      script_name(english:"Mandrake Linux Security Advisory : ipsec-tools (MDKSA-2004:069)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Mandrake Linux host is missing one or more security
    updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "A vulnerability in racoon prior to version 20040408a would allow a
    remote attacker to cause a DoS (memory consumption) via an ISAKMP
    packet with a large length field.
    
    Another vulnerability in racoon was discovered where, when using RSA
    signatures, racoon would validate the X.509 certificate but would not
    validate the signature. This can be exploited by an attacker sending a
    valid and trusted X.509 certificate and any private key. Using this,
    they could perform a man-in-the-middle attack and initiate an
    unauthorized connection. This has been fixed in ipsec-tools 0.3.3.
    
    The updated packages contain patches backported from 0.3.3 to correct
    the problem."
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "Update the affected ipsec-tools, lib64ipsec-tools0 and / or
    libipsec-tools0 packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:ipsec-tools");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:lib64ipsec-tools0");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:libipsec-tools0");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:mandrakesoft:mandrake_linux:10.0");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2004/07/14");
      script_set_attribute(attribute:"plugin_publication_date", value:"2004/07/31");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2004-2019 Tenable Network Security, Inc.");
      script_family(english:"Mandriva Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/Mandrake/release", "Host/Mandrake/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Mandrake/release")) audit(AUDIT_OS_NOT, "Mandriva / Mandake Linux");
    if (!get_kb_item("Host/Mandrake/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if (cpu !~ "^(amd64|i[3-6]86|x86_64)$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Mandriva / Mandrake Linux", cpu);
    
    
    flag = 0;
    if (rpm_check(release:"MDK10.0", reference:"ipsec-tools-0.2.5-0.2.100mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK10.0", cpu:"amd64", reference:"lib64ipsec-tools0-0.2.5-0.2.100mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK10.0", cpu:"i386", reference:"libipsec-tools0-0.2.5-0.2.100mdk", yank:"mdk")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2004-165.NASL
    descriptionAn updated ipsec-tools package that fixes vulnerabilities in racoon (the ISAKMP daemon) is now available. IPSEC uses strong cryptography to provide both authentication and encryption services. With versions of ipsec-tools prior to 0.2.3, it was possible for an attacker to cause unauthorized deletion of SA (Security Associations.) The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0164 to this issue. With versions of ipsec-tools prior to 0.2.5, the RSA signature on x.509 certificates was not properly verified when using certificate based authentication. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0155 to this issue. When ipsec-tools receives an ISAKMP header, it will attempt to allocate sufficient memory for the entire ISAKMP message according to the header
    last seen2020-06-01
    modified2020-06-02
    plugin id12488
    published2004-07-06
    reporterThis script is Copyright (C) 2004-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/12488
    titleRHEL 3 : ipsec-tools (RHSA-2004:165)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Red Hat Security Advisory RHSA-2004:165. The text 
    # itself is copyright (C) Red Hat, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(12488);
      script_version ("1.30");
      script_cvs_date("Date: 2019/10/25 13:36:10");
    
      script_cve_id("CVE-2004-0155", "CVE-2004-0164", "CVE-2004-0403");
      script_xref(name:"RHSA", value:"2004:165");
    
      script_name(english:"RHEL 3 : ipsec-tools (RHSA-2004:165)");
      script_summary(english:"Checks the rpm output for the updated package");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Red Hat host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "An updated ipsec-tools package that fixes vulnerabilities in racoon
    (the ISAKMP daemon) is now available.
    
    IPSEC uses strong cryptography to provide both authentication and
    encryption services.
    
    With versions of ipsec-tools prior to 0.2.3, it was possible for an
    attacker to cause unauthorized deletion of SA (Security Associations.)
    The Common Vulnerabilities and Exposures project (cve.mitre.org) has
    assigned the name CVE-2004-0164 to this issue.
    
    With versions of ipsec-tools prior to 0.2.5, the RSA signature on
    x.509 certificates was not properly verified when using certificate
    based authentication. The Common Vulnerabilities and Exposures project
    (cve.mitre.org) has assigned the name CVE-2004-0155 to this issue.
    
    When ipsec-tools receives an ISAKMP header, it will attempt to
    allocate sufficient memory for the entire ISAKMP message according to
    the header's length field. If an attacker crafts an ISAKMP header with
    a extremely large value in the length field, racoon may exceed
    operating system resource limits and be terminated, resulting in a
    denial of service. The Common Vulnerabilities and Exposures project
    (cve.mitre.org) has assigned the name CVE-2004-0403 to this issue.
    
    User of IPSEC should upgrade to this updated package, which contains
    ipsec-tools version 0.25 along with a security patch for CVE-2004-0403
    which resolves all these issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2004-0155"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2004-0164"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2004-0403"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/errata/RHSA-2004:165"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected ipsec-tools package."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:ipsec-tools");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:3");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2004/03/03");
      script_set_attribute(attribute:"patch_publication_date", value:"2004/05/11");
      script_set_attribute(attribute:"plugin_publication_date", value:"2004/07/06");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2004-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Red Hat Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat");
    os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat");
    os_ver = os_ver[1];
    if (! preg(pattern:"^3([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 3.x", "Red Hat " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu);
    
    yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo");
    if (!empty_or_null(yum_updateinfo)) 
    {
      rhsa = "RHSA-2004:165";
      yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);
      if (!empty_or_null(yum_report))
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : yum_report 
        );
        exit(0);
      }
      else
      {
        audit_message = "affected by Red Hat security advisory " + rhsa;
        audit(AUDIT_OS_NOT, audit_message);
      }
    }
    else
    {
      flag = 0;
      if (rpm_check(release:"RHEL3", reference:"ipsec-tools-0.2.5-0.4")) flag++;
    
      if (flag)
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : rpm_report_get() + redhat_report_package_caveat()
        );
        exit(0);
      }
      else
      {
        tested = pkg_tests_get();
        if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
        else audit(AUDIT_PACKAGE_NOT_INSTALLED, "ipsec-tools");
      }
    }
    
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-200406-17.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-200406-17 (IPsec-Tools: authentication bug in racoon) The KAME IKE daemon racoon is used to authenticate peers during Phase 1 when using either preshared keys, GSS-API, or RSA signatures. When using RSA signatures racoon validates the X.509 certificate but not the RSA signature. Impact : By sending a valid and trusted X.509 certificate and any private key an attacker could exploit this vulnerability to perform man-in-the-middle attacks and initiate unauthorized connections. Workaround : There is no known workaround at this time. All users are encouraged to upgrade to the latest available version.
    last seen2020-06-01
    modified2020-06-02
    plugin id14528
    published2004-08-30
    reporterThis script is Copyright (C) 2004-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/14528
    titleGLSA-200406-17 : IPsec-Tools: authentication bug in racoon
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Gentoo Linux Security Advisory GLSA 200406-17.
    #
    # The advisory text is Copyright (C) 2001-2015 Gentoo Foundation, Inc.
    # and licensed under the Creative Commons - Attribution / Share Alike 
    # license. See http://creativecommons.org/licenses/by-sa/3.0/
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(14528);
      script_version("1.15");
      script_cvs_date("Date: 2019/08/02 13:32:41");
    
      script_cve_id("CVE-2004-0155", "CVE-2004-0607");
      script_xref(name:"GLSA", value:"200406-17");
    
      script_name(english:"GLSA-200406-17 : IPsec-Tools: authentication bug in racoon");
      script_summary(english:"Checks for updated package(s) in /var/db/pkg");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Gentoo host is missing one or more security-related
    patches."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "The remote host is affected by the vulnerability described in GLSA-200406-17
    (IPsec-Tools: authentication bug in racoon)
    
        The KAME IKE daemon racoon is used to authenticate peers during Phase 1
        when using either preshared keys, GSS-API, or RSA signatures. When
        using RSA signatures racoon validates the X.509 certificate but not the
        RSA signature.
      
    Impact :
    
        By sending a valid and trusted X.509 certificate and any private key an
        attacker could exploit this vulnerability to perform man-in-the-middle
        attacks and initiate unauthorized connections.
      
    Workaround :
    
        There is no known workaround at this time. All users are encouraged to
        upgrade to the latest available version."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://ipsec-tools.sourceforge.net/x509sig.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security.gentoo.org/glsa/200406-17"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "All IPsec-Tools users should upgrade to the latest stable version:
        # emerge sync
        # emerge -pv '>=net-firewall/ipsec-tools-0.3.3'
        # emerge '>=net-firewall/ipsec-tools-0.3.3'"
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:ipsec-tools");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2004/06/22");
      script_set_attribute(attribute:"plugin_publication_date", value:"2004/08/30");
      script_set_attribute(attribute:"vuln_publication_date", value:"2004/04/02");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2004-2019 Tenable Network Security, Inc.");
      script_family(english:"Gentoo Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("qpkg.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo");
    if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    
    if (qpkg_check(package:"net-firewall/ipsec-tools", unaffected:make_list("ge 0.3.3"), vulnerable:make_list("lt 0.3.3"))) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = qpkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "IPsec-Tools");
    }
    
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_RACOON_20040407B.NASL
    descriptionThe following package needs to be updated: racoon
    last seen2016-09-26
    modified2004-07-06
    plugin id12608
    published2004-07-06
    reporterTenable
    sourcehttps://www.tenable.com/plugins/index.php?view=single&id=12608
    titleFreeBSD : racoon fails to verify signature during Phase 1 (163)
    code
    #%NASL_MIN_LEVEL 999999
    
    # @DEPRECATED@
    #
    # This script has been deprecated by freebsd_pkg_d8769838881411d890d10020ed76ef5a.nasl.
    #
    # Disabled on 2011/10/02.
    #
    
    #
    # (C) Tenable Network Security, Inc.
    #
    # This script contains information extracted from VuXML :
    #
    # Copyright 2003-2006 Jacques Vidrine and contributors
    #
    # Redistribution and use in source (VuXML) and 'compiled' forms (SGML,
    # HTML, PDF, PostScript, RTF and so forth) with or without modification,
    # are permitted provided that the following conditions are met:
    # 1. Redistributions of source code (VuXML) must retain the above
    #   copyright notice, this list of conditions and the following
    #   disclaimer as the first lines of this file unmodified.
    # 2. Redistributions in compiled form (transformed to other DTDs,
    #   published online in any format, converted to PDF, PostScript,
    #   RTF and other formats) must reproduce the above copyright
    #   notice, this list of conditions and the following disclaimer
    #   in the documentation and/or other materials provided with the
    #   distribution.
    #
    # THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS "AS IS"
    # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
    # THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
    # PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS
    # BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
    # OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
    # OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
    # BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
    # WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
    # OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,
    # EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
    #
    #
    #
    
    include('compat.inc');
    
    if ( description )
    {
     script_id(12608);
     script_version("1.12");
     script_cve_id("CVE-2004-0155");
    
     script_name(english:"FreeBSD : racoon fails to verify signature during Phase 1 (163)");
    
    script_set_attribute(attribute:'synopsis', value: 'The remote host is missing a security update');
    script_set_attribute(attribute:'description', value:'The following package needs to be updated: racoon');
    script_set_attribute(attribute: 'cvss_vector', value: 'CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P');
    script_set_attribute(attribute:'solution', value: 'Update the package on the remote host');
    script_set_attribute(attribute: 'see_also', value: 'http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/2947
    http://secunia.com/advisories/11817
    http://secunia.com/advisories/12309
    http://secunia.com/advisories/17571/
    http://security.e-matters.de/advisories/092004.html
    http://www.idefense.com/application/poi/display?id=130&amp;type=vulnerabilities&amp;flashstatus=false
    http://www.kame.net/dev/cvsweb2.cgi/kame/kame/kame/racoon/crypto_openssl.c?rev=1.84&amp;content-type=text/x-cvsweb-markup
    http://www.mozilla.org/security/announce/2006/mfsa2006-09.html
    http://www.mozilla.org/security/announce/2006/mfsa2006-10.html
    http://www.mozilla.org/security/announce/2006/mfsa2006-11.html
    http://www.mozilla.org/security/announce/2006/mfsa2006-12.html
    http://www.mozilla.org/security/announce/2006/mfsa2006-13.html
    http://www.mozilla.org/security/announce/2006/mfsa2006-14.html
    http://www.mozilla.org/security/announce/2006/mfsa2006-15.html
    https://ccvs.cvshome.org/source/browse/ccvs/NEWS?rev=1.116.2.104');
    script_set_attribute(attribute:'see_also', value: 'http://www.FreeBSD.org/ports/portaudit/d8769838-8814-11d8-90d1-0020ed76ef5a.html');
    
     script_set_attribute(attribute:"plugin_publication_date", value: "2004/07/06");
     script_end_attributes();
     script_summary(english:"Check for racoon");
     script_category(ACT_GATHER_INFO);
     script_copyright(english:"This script is Copyright (C) 2009-2018 Tenable Network Security, Inc.");
     family["english"] = "FreeBSD Local Security Checks";
     script_family(english:family["english"]);
     script_dependencies("ssh_get_info.nasl");
     script_require_keys("Host/FreeBSD/pkg_info");
     exit(0);
    }
    
    # Deprecated.
    exit(0, "This plugin has been deprecated. Refer to plugin #37923 (freebsd_pkg_d8769838881411d890d10020ed76ef5a.nasl) instead.");
    
    global_var cvss_score;
    cvss_score=7;
    include('freebsd_package.inc');
    
    
    pkg_test(pkg:"racoon<20040407b");
    
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_D8769838881411D890D10020ED76EF5A.NASL
    descriptionRalf Spenneberg discovered a serious flaw in racoon. When using Phase 1 main or aggressive mode, racoon does not verify the client
    last seen2020-06-01
    modified2020-06-02
    plugin id37923
    published2009-04-23
    reporterThis script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/37923
    titleFreeBSD : racoon fails to verify signature during Phase 1 (d8769838-8814-11d8-90d1-0020ed76ef5a)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from the FreeBSD VuXML database :
    #
    # Copyright 2003-2018 Jacques Vidrine and contributors
    #
    # Redistribution and use in source (VuXML) and 'compiled' forms (SGML,
    # HTML, PDF, PostScript, RTF and so forth) with or without modification,
    # are permitted provided that the following conditions are met:
    # 1. Redistributions of source code (VuXML) must retain the above
    #    copyright notice, this list of conditions and the following
    #    disclaimer as the first lines of this file unmodified.
    # 2. Redistributions in compiled form (transformed to other DTDs,
    #    published online in any format, converted to PDF, PostScript,
    #    RTF and other formats) must reproduce the above copyright
    #    notice, this list of conditions and the following disclaimer
    #    in the documentation and/or other materials provided with the
    #    distribution.
    # 
    # THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS "AS IS"
    # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
    # THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
    # PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS
    # BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
    # OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
    # OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
    # BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
    # WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
    # OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,
    # EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(37923);
      script_version("1.11");
      script_cvs_date("Date: 2019/08/02 13:32:36");
    
      script_cve_id("CVE-2004-0155");
    
      script_name(english:"FreeBSD : racoon fails to verify signature during Phase 1 (d8769838-8814-11d8-90d1-0020ed76ef5a)");
      script_summary(english:"Checks for updated package in pkg_info output");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote FreeBSD host is missing a security-related update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Ralf Spenneberg discovered a serious flaw in racoon. When using Phase
    1 main or aggressive mode, racoon does not verify the client's RSA
    signature. Any installations using X.509 authentication are strongly
    urged to upgrade.
    
    Installations using pre-shared keys are believed to be unaffected."
      );
      # http://www.kame.net/dev/cvsweb2.cgi/kame/kame/kame/racoon/crypto_openssl.c?rev=1.84&content-type=text/x-cvsweb-markup
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?49e118d8"
      );
      # https://vuxml.freebsd.org/freebsd/d8769838-8814-11d8-90d1-0020ed76ef5a.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?5256f647"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected package.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:racoon");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:freebsd:freebsd");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2004/04/05");
      script_set_attribute(attribute:"patch_publication_date", value:"2004/04/07");
      script_set_attribute(attribute:"plugin_publication_date", value:"2009/04/23");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"FreeBSD Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/FreeBSD/release", "Host/FreeBSD/pkg_info");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("freebsd_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/FreeBSD/release")) audit(AUDIT_OS_NOT, "FreeBSD");
    if (!get_kb_item("Host/FreeBSD/pkg_info")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    
    if (pkg_test(save_report:TRUE, pkg:"racoon<20040407b")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:pkg_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyMandriva Local Security Checks
    NASL idMANDRAKE_MDKSA-2004-027.NASL
    descriptionA very serious security flaw was discovered by Ralf Spenneberg in racoon, the IKE daemon of the KAME-tools. Racoon does not very the RSA signature during phase one of a connection using either main or aggressive mode. Only the certificate of the client is verified, the certificate is not used to verify the client
    last seen2020-06-01
    modified2020-06-02
    plugin id14126
    published2004-07-31
    reporterThis script is Copyright (C) 2004-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/14126
    titleMandrake Linux Security Advisory : ipsec-tools (MDKSA-2004:027)
    code
    #%NASL_MIN_LEVEL 80502
    
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Mandrake Linux Security Advisory MDKSA-2004:027. 
    # The text itself is copyright (C) Mandriva S.A.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(14126);
      script_version ("1.19");
      script_cvs_date("Date: 2019/08/02 13:32:47");
    
      script_cve_id("CVE-2004-0155");
      script_xref(name:"MDKSA", value:"2004:027");
    
      script_name(english:"Mandrake Linux Security Advisory : ipsec-tools (MDKSA-2004:027)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Mandrake Linux host is missing one or more security
    updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "A very serious security flaw was discovered by Ralf Spenneberg in
    racoon, the IKE daemon of the KAME-tools. Racoon does not very the RSA
    signature during phase one of a connection using either main or
    aggressive mode. Only the certificate of the client is verified, the
    certificate is not used to verify the client's signature.
    
    All versions of ipsec-tools prior to 0.2.5 and 0.3rc5 are vulnerable
    to this issue. The provided package updates ipsec-tools to 0.2.5."
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected ipsec-tools and / or libipsec-tools0 packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:ipsec-tools");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:libipsec-tools0");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:mandrakesoft:mandrake_linux:10.0");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2004/04/08");
      script_set_attribute(attribute:"plugin_publication_date", value:"2004/07/31");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2004-2019 Tenable Network Security, Inc.");
      script_family(english:"Mandriva Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/Mandrake/release", "Host/Mandrake/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Mandrake/release")) audit(AUDIT_OS_NOT, "Mandriva / Mandake Linux");
    if (!get_kb_item("Host/Mandrake/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if (cpu !~ "^(amd64|i[3-6]86|x86_64)$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Mandriva / Mandrake Linux", cpu);
    
    
    flag = 0;
    if (rpm_check(release:"MDK10.0", cpu:"i386", reference:"ipsec-tools-0.2.5-0.1.100mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK10.0", cpu:"i386", reference:"libipsec-tools0-0.2.5-0.1.100mdk", yank:"mdk")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    

Oval

  • accepted2013-04-29T04:18:40.601-04:00
    classvulnerability
    contributors
    • nameAharon Chernin
      organizationSCAP.com, LLC
    • nameDragos Prisaca
      organizationG2, Inc.
    definition_extensions
    • commentThe operating system installed on the system is Red Hat Enterprise Linux 3
      ovaloval:org.mitre.oval:def:11782
    • commentCentOS Linux 3.x
      ovaloval:org.mitre.oval:def:16651
    descriptionThe KAME IKE Daemon Racoon, when authenticating a peer during Phase 1, validates the X.509 certificate but does not verify the RSA signature authentication, which allows remote attackers to establish unauthorized IP connections or conduct man-in-the-middle attacks using a valid, trusted X.509 certificate.
    familyunix
    idoval:org.mitre.oval:def:9291
    statusaccepted
    submitted2010-07-09T03:56:16-04:00
    titleThe KAME IKE Daemon Racoon, when authenticating a peer during Phase 1, validates the X.509 certificate but does not verify the RSA signature authentication, which allows remote attackers to establish unauthorized IP connections or conduct man-in-the-middle attacks using a valid, trusted X.509 certificate.
    version26
  • accepted2010-09-20T04:00:46.730-04:00
    classvulnerability
    contributors
    • nameJay Beale
      organizationBastille Linux
    • nameThomas R. Jones
      organizationMaitreya Security
    • nameJonathan Baker
      organizationThe MITRE Corporation
    descriptionThe KAME IKE Daemon Racoon, when authenticating a peer during Phase 1, validates the X.509 certificate but does not verify the RSA signature authentication, which allows remote attackers to establish unauthorized IP connections or conduct man-in-the-middle attacks using a valid, trusted X.509 certificate.
    familyunix
    idoval:org.mitre.oval:def:945
    statusaccepted
    submitted2004-05-12T12:00:00.000-04:00
    titleRacoon IKE Daemon Unauthorized X.509 Certificate Connection Vulnerability
    version39

Redhat

advisories
rhsa
idRHSA-2004:165
rpms
  • ipsec-tools-0:0.2.5-0.4
  • ipsec-tools-debuginfo-0:0.2.5-0.4