[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <885b2658-698a-7030-f3bc-edec7208b3ba@redhat.com>
Date: Mon, 13 Jun 2016 09:55:48 +0530
From: Huzaifa Sidhpurwala <huzaifas@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: Re: CVE Request: IKEv1 protocol is vulnerable to
DoS amplification attack
On 06/10/2016 06:04 PM, cve-assign@...re.org wrote:
>> I would like to request a CVE for the protocol flaw in IKEv1, details below:
>
>> https://www.kb.cert.org/vuls/id/419128
>> https://blogs.akamai.com/2016/02/ikeikev2-ripe-for-ddos-abuse.html
>
>> https://bugzilla.redhat.com/show_bug.cgi?id=1308508
>> https://github.com/libreswan/libreswan/commit/152d6d95632d8b9477c170f1de99bcd86d7fb1d6
>> https://lists.libreswan.org/pipermail/swan-dev/2016-March/001394.html
>
>> Can a CVE id be please assigned to this?
>
> CVE IDs are not assigned to UDP protocols solely on the basis of an
> observed amplification-attack risk. A CVE ID can exist if the UDP
> reply traffic simply cannot ever have any legitimate purpose for users
> of a protocol. The general case of the interaction between UDP
> amplification and CVE was discussed between MITRE and CERT in 2013;
> this may be the reason that no CVE ID is listed in the
> https://www.kb.cert.org/vuls/id/419128 document.
>
In that case, no CVE should be assigned to this issue as well. Its not
libreswan which is flawed, but its the protocol which they are trying to
implement.
> We can, however, assign a CVE ID to a vendor's announcement of a
> required security update, such as on the https://libreswan.org/ home
> page:
>
> "libreswan 3.16 vulnerable to DDOS attack. Please upgrade to 3.17"
>
> Use CVE-2016-5361 for this issue only in the libreswan codebase.
>
>
Also the following products (which implement IKEv1 are flawed, since
they follow this protocol)
ipsec-tools
racoon2
openswan
strongswan
libreswan
ike
vpnc
(There may be others, but i can only think of the above)
--
Huzaifa Sidhpurwala / Red Hat Product Security Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
