[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 7 Jul 2016 16:27:08 +0000
From: "Seaman, Chad" <cseaman@...mai.com>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
CC: "huzaifas@...hat.com" <huzaifas@...hat.com>, "cve-assign@...re.org"
<cve-assign@...re.org>
Subject: Re: CVE Request: IKEv1 protocol is vulnerable to DoS
amplification attack
Hi All,
I’m Chad Seaman @ Akamai, the researcher who found, researched, and wrote the paper on the IKEv1 and IKEv2 flaws that could lead to amplification attacks.
The opening e-mail states that IKEv2 is not believed to be affected, I can confirm that in some cases some implementations are indeed affected.
There was some doubts about IKEv2 being affected and I was contacted by a Cisco engineer as well as one of the RFC authors, we constructed multiple IKEv2 probe payloads and did a series of secondary scans that specifically targeted IKEv2 hosts to confirm these results.
Where hosts should respond once based on IKEv2 RFC specs, hundreds of thousands reply multiple times, roughly 110,000 reply 21 times or more per single probe, some of the worst offenders responded thousands of times.
Regards,
Chad
> On Jun 14, 2016, at 10:34 AM, Paul Wouters <pwouters@...hat.com> wrote:
>
> On 06/13/2016 10:40 AM, cve-assign@...re.org wrote:
>>> Its not libreswan which is flawed, but its the protocol which they are trying to implement.
>>
>>> which implement IKEv1 are flawed, since they follow this protocol
>>
>> Many protocols could be described as "flawed." The IKEv1 protocol amplification concern does not make it flawed in a way that would lead to a per-protocol
>> CVE ID assignment.
>
> Then you should pull the CVE-2016-5361 which deals with retransmission amplification in IKEv1
>
> We are maintaining the
>> CVE-2016-5361 ID assignment for the upstream announcement of "libreswan 3.16 vulnerable to DDOS attack. Please upgrade to 3.17"
>
> That statement on the libreswan website is clearly referring to CVE-2016-3071 not CVE-2016-5361.
>
> and
>> accompanying upstream patch, as described in the http://www.openwall.com/lists/oss-security/2016/06/10/4 post.
>
> Which again clearly refers to CVE-2016-5361 and not CVE-2016-3071
>
> So again, please fix CVE-2016-5361 or drop it.
>
> Paul
Download attachment "signature.asc" of type "application/pgp-signature" (843 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
