Red Hat Security AdvisoryRHSA-2008:0849
ipsec-tools security update
Released 2008-08-26 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Desktop version 3 ipsec-tools-0.2.5-0.7.rhel3.5, ipsec-tools-0.2.5-0.7.rhel3.5.i386
- Red Hat Enterprise Linux (v. 5 server) ipsec-tools-0.6.5-9.el5_2.3, ipsec-tools-0.6.5-9.el5_2.3.i386, ipsec-tools-0.6.5-9.el5_2.3.ia64 +1
- Red Hat Enterprise Linux AS version 3 ipsec-tools-0.2.5-0.7.rhel3.5, ipsec-tools-0.2.5-0.7.rhel3.5.i386, ipsec-tools-0.2.5-0.7.rhel3.5.ia64 +1
- Red Hat Enterprise Linux AS version 4 ipsec-tools-0.3.3-7.el4_7, ipsec-tools-0.3.3-7.el4_7.i386, ipsec-tools-0.3.3-7.el4_7.ia64 +1
- Red Hat Enterprise Linux Desktop (v. 5 client) ipsec-tools-0.6.5-9.el5_2.3, ipsec-tools-0.6.5-9.el5_2.3.i386
- Red Hat Enterprise Linux Desktop version 4 ipsec-tools-0.3.3-7.el4_7, ipsec-tools-0.3.3-7.el4_7.i386
- Red Hat Enterprise Linux ES version 3 ipsec-tools-0.2.5-0.7.rhel3.5, ipsec-tools-0.2.5-0.7.rhel3.5.i386, ipsec-tools-0.2.5-0.7.rhel3.5.ia64
- Red Hat Enterprise Linux ES version 4 ipsec-tools-0.3.3-7.el4_7, ipsec-tools-0.3.3-7.el4_7.i386, ipsec-tools-0.3.3-7.el4_7.ia64
- Red Hat Enterprise Linux WS version 3 ipsec-tools-0.2.5-0.7.rhel3.5, ipsec-tools-0.2.5-0.7.rhel3.5.i386, ipsec-tools-0.2.5-0.7.rhel3.5.ia64
- Red Hat Enterprise Linux WS version 4 ipsec-tools-0.3.3-7.el4_7, ipsec-tools-0.3.3-7.el4_7.i386, ipsec-tools-0.3.3-7.el4_7.ia64
Fixes 2 records
Priority MEDIUM 40
src/racoon/handler.c in racoon in ipsec-tools does not remove an "orphaned ph1" (phase 1) handle when it has been initiated remotely, which allows remote attackers to cause a denial of service (resource consumption).
CVSS 2.0HIGH 7.8· Network · No auth · Interaction — · EPSS 0.03435 · Published 2008-08-13 · Fixed CWE-399
Priority LOW 23
Memory leak in racoon/proposal.c in the racoon daemon in ipsec-tools before 0.7.1 allows remote authenticated users to cause a denial of service (memory consumption) via invalid proposals.
CVSS 2.0MEDIUM 4.0· Network · Low privileges · Interaction — · EPSS 0.02316 · Published 2008-08-13 · Fixed CWE-200
