full-disclosure - [ MDVSA-2009:114 ] ipsec-tools

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <E1M630a-00060R-UZ@titan.mandriva.com>
Date: Mon, 18 May 2009 15:36:00 +0200
From: security@...driva.com
To: full-disclosure@...ts.grok.org.uk
Subject: [ MDVSA-2009:114 ] ipsec-tools


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2009:114
 http://www.mandriva.com/security/
 _______________________________________________________________________

 Package : ipsec-tools
 Date    : May 18, 2009
 Affected: Corporate 4.0, Multi Network Firewall 2.0
 _______________________________________________________________________

 Problem Description:

 Multiple memory leaks in Ipsec-tools before 0.7.2 allow remote
 attackers to cause a denial of service (memory consumption) via vectors
 involving (1) signature verification during user authentication with
 X.509 certificates, related to the eay_check_x509sign function in
 src/racoon/crypto_openssl.c; and (2) the NAT-Traversal (aka NAT-T)
 keepalive implementation, related to src/racoon/nattraversal.c
 (CVE-2009-1632).
 
 The updated packages have been patched to prevent this.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1632
 _______________________________________________________________________

 Updated Packages:

 Corporate 4.0:
 4ccc0eafc222a8a5976a0e9eebbc7499  corporate/4.0/i586/ipsec-tools-0.6.5-2.4.20060mlcs4.i586.rpm
 f244df60a927a7aa4a539c2e8d9c699a  corporate/4.0/i586/libipsec0-0.6.5-2.4.20060mlcs4.i586.rpm
 95443caad35eb54d1f291f7368aac511  corporate/4.0/i586/libipsec0-devel-0.6.5-2.4.20060mlcs4.i586.rpm 
 0e9a4820ef81a4917d9c0a9c5befa27b  corporate/4.0/SRPMS/ipsec-tools-0.6.5-2.4.20060mlcs4.src.rpm

 Corporate 4.0/X86_64:
 a1ccfd8a891340f52aa2f64d69e46e47  corporate/4.0/x86_64/ipsec-tools-0.6.5-2.4.20060mlcs4.x86_64.rpm
 44ed76407c8633fcea7f4a3ab94f1842  corporate/4.0/x86_64/lib64ipsec0-0.6.5-2.4.20060mlcs4.x86_64.rpm
 d7a3ecf831ecfcbc1319558303a1be17  corporate/4.0/x86_64/lib64ipsec0-devel-0.6.5-2.4.20060mlcs4.x86_64.rpm 
 0e9a4820ef81a4917d9c0a9c5befa27b  corporate/4.0/SRPMS/ipsec-tools-0.6.5-2.4.20060mlcs4.src.rpm

 Multi Network Firewall 2.0:
 f43aaba27d5ff88b38db39ebeaaaf5cd  mnf/2.0/i586/ipsec-tools-0.2.5-0.7.M20mdk.i586.rpm
 fb19d1e75fd8f08ce9dc1586cdf9fa3b  mnf/2.0/i586/libipsec-tools0-0.2.5-0.7.M20mdk.i586.rpm 
 2db168e39d44b361bab9ada981edaa90  mnf/2.0/SRPMS/ipsec-tools-0.2.5-0.7.M20mdk.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFKETmdmqjQ0CJFipgRAloWAJ9wHsc3F9b0lI8E87n8+gT7j4t+jACg8OD2
obN0TVwX9QBtElK0wQeibi8=
=dlxS
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/