full-disclosure - [FD] IKE Aggressive Mode Downgrade Attack?

Open Source and information security mailing list archives

Date: Thu, 30 Apr 2015 14:34:53 +0200
From: Melchior Limacher <mli@...tect7.com>
To: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>
Subject: [FD] IKE Aggressive Mode Downgrade Attack?

Hello

I was reading about "ike aggressive mode with pre shared key" (CVE-2002-1623).

As described by cisco (http://www.cisco.com/en/US/tech/tk583/tk372/technologies_security_notice09186a008016b57f.html), this is still an issue
"When responding to IPSec session initialization, Cisco IOS(r) software
may use Aggressive Mode even if it has not been explicitly configured
to do so. Cisco IOS software initially tries to negotiate using Main
Mode but, failing that, resorts to Aggressive Mode."

Are there known downgrade attacks? Counter-Measures?

Thanks for your feedback and regards,
mli

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives