Login
Newsletter
Werbung

Sicherheit: Denial of Service in ipsec-tools
Aktuelle Meldungen Distributionen
Name: Denial of Service in ipsec-tools
ID: MDVSA-2009:112
Distribution: Mandriva
Plattformen: Mandriva Corporate 4.0, Mandriva 2008.1, Mandriva 2009.0, Mandriva 2009.1
Datum: Mi, 13. Mai 2009, 23:46
Referenzen: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1574
Applikationen: IPsec-Tools

Originalnachricht

This is a multi-part message in MIME format...

------------=_1242251160-27111-3306


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2009:112
http://www.mandriva.com/security/
_______________________________________________________________________

Package : ipsec-tools
Date : May 13, 2009
Affected: 2008.1, 2009.0, 2009.1, Corporate 4.0
_______________________________________________________________________

Problem Description:

racoon/isakmp_frag.c in ipsec-tools before 0.7.2 allows remote
attackers to cause a denial of service (crash) via crafted fragmented
packets without a payload, which triggers a NULL pointer dereference
(CVE-2009-1574).

Updated packages are available that brings ipsec-tools to version
0.7.2 for Mandriva Linux 2008.1/2009.0/2009.1 which provides numerous
bugfixes over the previous 0.7.1 version, and also corrects this
issue. ipsec-tools for Mandriva Linux Corporate Server 4 has been
patched to address this issue.

Additionally the flex package required for building ipsec-tools has
been fixed due to ipsec-tools build problems and is also available
with this update.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1574
_______________________________________________________________________

Updated Packages:

Mandriva Linux 2008.1:
d9878eb00cd2eab1ddab465ae1cc77d4
2008.1/i586/flex-2.5.33-3.1mdv2008.1.i586.rpm
9f806b3e098e21f478cbe7b342c4788d
2008.1/i586/ipsec-tools-0.7.2-0.1mdv2008.1.i586.rpm
417be6a91d0f9959adde599b31281e18
2008.1/i586/libipsec0-0.7.2-0.1mdv2008.1.i586.rpm
ddea0f917e8c20428f8f82e6bc5fc84f
2008.1/i586/libipsec-devel-0.7.2-0.1mdv2008.1.i586.rpm
2df69acaabd5b1bd4ae9559b50a2fe38
2008.1/SRPMS/flex-2.5.33-3.1mdv2008.1.src.rpm
073dd7f429789e991ce2140ae94dc9e3
2008.1/SRPMS/ipsec-tools-0.7.2-0.1mdv2008.1.src.rpm

Mandriva Linux 2008.1/X86_64:
7540e1692e011f5751b70ca5f813d30e
2008.1/x86_64/flex-2.5.33-3.1mdv2008.1.x86_64.rpm
e3b5eaafbfbb853fc8570b57bd24ca8f
2008.1/x86_64/ipsec-tools-0.7.2-0.1mdv2008.1.x86_64.rpm
bed8cf24ce2d9f7e0762330f03fe9f77
2008.1/x86_64/lib64ipsec0-0.7.2-0.1mdv2008.1.x86_64.rpm
6d9a2a1a75c2541556c8961f50a8db44
2008.1/x86_64/lib64ipsec-devel-0.7.2-0.1mdv2008.1.x86_64.rpm
2df69acaabd5b1bd4ae9559b50a2fe38
2008.1/SRPMS/flex-2.5.33-3.1mdv2008.1.src.rpm
073dd7f429789e991ce2140ae94dc9e3
2008.1/SRPMS/ipsec-tools-0.7.2-0.1mdv2008.1.src.rpm

Mandriva Linux 2009.0:
ed0510b3f70d276a944a1d08dd2d8cc1
2009.0/i586/flex-2.5.35-2.1mdv2009.0.i586.rpm
05d955250a465bf3db080b3030601169
2009.0/i586/ipsec-tools-0.7.2-0.1mdv2009.0.i586.rpm
ced5cda86b12e2fab5c1bbcccda4712f
2009.0/i586/libipsec0-0.7.2-0.1mdv2009.0.i586.rpm
7dc487599f48ba11d5ce532949854afd
2009.0/i586/libipsec-devel-0.7.2-0.1mdv2009.0.i586.rpm
d2f12938586e4487a63cd930b8766f3c
2009.0/SRPMS/flex-2.5.35-2.1mdv2009.0.src.rpm
151ae87db743b0cae0eaa30edd4bf0db
2009.0/SRPMS/ipsec-tools-0.7.2-0.1mdv2009.0.src.rpm

Mandriva Linux 2009.0/X86_64:
11f863a96976eae23b36b2d84b88bc05
2009.0/x86_64/flex-2.5.35-2.1mdv2009.0.x86_64.rpm
171ef0199e2cb79c5c8e9577fd4eab0b
2009.0/x86_64/ipsec-tools-0.7.2-0.1mdv2009.0.x86_64.rpm
9e30ebce0b6cda0ca64282e84e19bab7
2009.0/x86_64/lib64ipsec0-0.7.2-0.1mdv2009.0.x86_64.rpm
d94c59428164d08cc73a65b45a936b89
2009.0/x86_64/lib64ipsec-devel-0.7.2-0.1mdv2009.0.x86_64.rpm
d2f12938586e4487a63cd930b8766f3c
2009.0/SRPMS/flex-2.5.35-2.1mdv2009.0.src.rpm
151ae87db743b0cae0eaa30edd4bf0db
2009.0/SRPMS/ipsec-tools-0.7.2-0.1mdv2009.0.src.rpm

Mandriva Linux 2009.1:
e99fc0e432bcf6d8d6bda9099ebf1fe5
2009.1/i586/flex-2.5.35-3.1mdv2009.1.i586.rpm
7e91d7a68657858af9c54a12c4fb8464
2009.1/i586/ipsec-tools-0.7.2-0.1mdv2009.1.i586.rpm
8dd23d6335cf66b6fd3dad3695450495
2009.1/i586/libipsec0-0.7.2-0.1mdv2009.1.i586.rpm
75ba0568d29e9c5963f6d0a829dd5399
2009.1/i586/libipsec-devel-0.7.2-0.1mdv2009.1.i586.rpm
1179bd2ca09c92a74c53dd968d42dd41
2009.1/SRPMS/flex-2.5.35-3.1mdv2009.1.src.rpm
27805cc0683e81278c07ad042cd699f6
2009.1/SRPMS/ipsec-tools-0.7.2-0.1mdv2009.1.src.rpm

Mandriva Linux 2009.1/X86_64:
b6cfd4de694b49af45bb4a393d442132
2009.1/x86_64/flex-2.5.35-3.1mdv2009.1.x86_64.rpm
34542c4ab11123ca26d66d54f20b7785
2009.1/x86_64/ipsec-tools-0.7.2-0.1mdv2009.1.x86_64.rpm
cfa784d23e7d386683129e12efe500a6
2009.1/x86_64/lib64ipsec0-0.7.2-0.1mdv2009.1.x86_64.rpm
cb931729a533fe7accbc894fe4417ed0
2009.1/x86_64/lib64ipsec-devel-0.7.2-0.1mdv2009.1.x86_64.rpm
1179bd2ca09c92a74c53dd968d42dd41
2009.1/SRPMS/flex-2.5.35-3.1mdv2009.1.src.rpm
27805cc0683e81278c07ad042cd699f6
2009.1/SRPMS/ipsec-tools-0.7.2-0.1mdv2009.1.src.rpm

Corporate 4.0:
7b0e5364626bc882bc3cdcd6b9c26f13
corporate/4.0/i586/ipsec-tools-0.6.5-2.3.20060mlcs4.i586.rpm
809b36a5a2edad597edd1249c0b5950c
corporate/4.0/i586/libipsec0-0.6.5-2.3.20060mlcs4.i586.rpm
88949442ee4678ed0f6327d8427da16c
corporate/4.0/i586/libipsec0-devel-0.6.5-2.3.20060mlcs4.i586.rpm
5039010d191736aa3657e5ce74f15b34
corporate/4.0/SRPMS/ipsec-tools-0.6.5-2.3.20060mlcs4.src.rpm

Corporate 4.0/X86_64:
835b82cd18e78f3562ceabcc58050226
corporate/4.0/x86_64/ipsec-tools-0.6.5-2.3.20060mlcs4.x86_64.rpm
a71843b2cd9c5d02875f9ba339ef8827
corporate/4.0/x86_64/lib64ipsec0-0.6.5-2.3.20060mlcs4.x86_64.rpm
35fe487a2bd39e5ddbbae5d4ff54a68e
corporate/4.0/x86_64/lib64ipsec0-devel-0.6.5-2.3.20060mlcs4.x86_64.rpm
5039010d191736aa3657e5ce74f15b34
corporate/4.0/SRPMS/ipsec-tools-0.6.5-2.3.20060mlcs4.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFKCxJqmqjQ0CJFipgRAtNjAKDT/r7mDFhyggR83f/afoLepfmzSACg65He
U78jJGj2oohufDisddD5Y/o=
=pV+P
-----END PGP SIGNATURE-----


------------=_1242251160-27111-3306
Content-Type: text/plain; name="message-footer.txt"
Content-Disposition: inline; filename="message-footer.txt"
Content-Transfer-Encoding: 8bit

To unsubscribe, send a email to sympa@mandrivalinux.org
with this subject : unsubscribe security-announce
_______________________________________________________
Want to buy your Pack or Services from Mandriva?
Go to http://www.mandrivastore.com
Join the Club : http://www.mandrivaclub.com
_______________________________________________________

------------=_1242251160-27111-3306--
Pro-Linux
Pro-Linux @Facebook
Neue Nachrichten
Werbung