[gentoo-security] Re: [ GLSA 200404-17 ] ipsec-tools and iputils contain a remote DoS vulnerability

[Troy Farrell]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Is it normal to have GLSA-suggested updates be masked?

*****
root@localhost root # emerge -pv ">=net-misc/iputils-021109-r3"

These are the packages that I would merge, in order:

Calculating dependencies
!!! all ebuilds that could satisfy ">=net-misc/iputils-021109-r3" have been masked.
!!! possible candidates are:
- - net-misc/iputils-021109-r3 (masked by: ~keyword)

!!! Error calculating dependencies. Please correct.
root@localhost root # emerge -pv iputils

These are the packages that I would merge, in order:

Calculating dependencies ...done!
[ebuild   R   ] net-misc/iputils-020927  -static  118 kB

Am I missing something?

Thanks.
Troy

- --
And the glory of the LORD shall be revealed, and all flesh shall see it
together: for the mouth of the LORD hath spoken it.
Isaiah 40.5

0xD3BDCA53 http://tjf.us/public.asc


Kurt Lieber wrote:
| - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
| Gentoo Linux Security Advisory                           GLSA 200404-17
| - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
|                                             http://security.gentoo.org/
| - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
|
|   Severity: Normal
|      Title: ipsec-tools and iputils contain a remote DoS vulnerability
|
|       Date: April 24, 2004
|       Bugs: #48847
|         ID: 200404-17
|
| - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
|
| Synopsis
| ========
|
| racoon, which is included in the ipsec-tools and iputils packages in
| Portage, does not check the length of ISAKMP headers. Attackers may be
| able to craft an ISAKMP header of sufficient length to consume all
| available system resoources, causing a Denial of Service.
|
| Background
| ==========
|
| From http://ipsec-tools.sourceforge.net/ :
|
| "IPsec-Tools is a port of KAME's IPsec utilities to the Linux-2.6 IPsec
| implementation."
|
| iputils is a collection of network monitoring tools, including racoon,
| ping and ping6.
|
| Affected packages
| =================
|
|     -------------------------------------------------------------------
|      Package                   /    Vulnerable    /         Unaffected
|     -------------------------------------------------------------------
|      net-firewall/ipsec-tools         < 0.3.1                 >= 0.3.1
|      net-misc/iputils              == 021109-r1           == 021109-r3
|
| Description
| ===========
|
| When racoon receives an ISAKMP header, it allocates memory based on the
| length of the header field. Thus, an attacker may be able to cause a
| Denial of Services by creating a header that is large enough to consume
| all available system resources.
|
| Impact
| ======
|
| This vulnerability may allow an attacker to remotely cause a Denial of
| Service.
|
| Workaround
| ==========
|
| A workaround is not currently known for this issue. All users are
| advised to upgrade to the latest version of the affected package.
|
| Resolution
| ==========
|
| ipsec-tools users should upgrade to version 0.2.5 or later:
|
|     # emerge sync
|
|     # emerge -pv ">=net-firewall/ipsec-tools-0.3.1"
|     # emerge ">=net-firewall/ipsec-tools-0.3.1"
|
| iputils users should upgrade to version 021109-r3 or later:
|
|     # emerge sync
|
|     # emerge -pv ">=net-misc/iputils-021109-r3"
|     # emerge ">=net-misc/iputils-021109-r3"
|
| References
| ==========
|
|   [ 1 ] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0403
|
| Availability
| ============
|
| This GLSA and any updates to it are available for viewing at
| the Gentoo Security Website:
|
|      http://security.gentoo.org/glsa/glsa-200404-17.xml
|
| Concerns?
| =========
|
| Security is a primary focus of Gentoo Linux and ensuring the
| confidentiality and security of our users machines is of utmost
| importance to us. Any security concerns should be addressed to
| security@g.o or alternatively, you may file a bug at
| http://bugs.gentoo.org.
|
| License
| =======
|
| Copyright 2004 Gentoo Technologies, Inc; referenced text
| belongs to its owner(s).
|
| The contents of this document are licensed under the
| Creative Commons - Attribution / Share Alike license.
|
| http://creativecommons.org/licenses/by-sa/1.0
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFAiq9IAykmMtO9ylMRAg0tAJ92rxbbXdH+QeeLTZdPD+eLggUp3gCfXsSC
yvtVhvHvs1VdlwY3mqbAfw8=
=HBcA
-----END PGP SIGNATURE-----

--
gentoo-security@g.o mailing list