[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 8 Jul 2016 11:16:33 +0300
From: Paul Wouters <pwouters@...hat.com>
To: oss-security@...ts.openwall.com
Cc: "huzaifas@...hat.com" <huzaifas@...hat.com>,
"cve-assign@...re.org" <cve-assign@...re.org>
Subject: Re: CVE Request: IKEv1 protocol is vulnerable to DoS
amplification attack
On 07/07/2016 07:27 PM, Seaman, Chad wrote:
> Hi All,
>
> I’m Chad Seaman @ Akamai, the researcher who found, researched, and wrote the paper on the IKEv1 and IKEv2 flaws that could lead to amplification attacks.
>
> The opening e-mail states that IKEv2 is not believed to be affected, I can confirm that in some cases some implementations are indeed affected.
>
> There was some doubts about IKEv2 being affected and I was contacted by a Cisco engineer as well as one of the RFC authors, we constructed multiple IKEv2
> probe payloads and did a series of secondary scans that specifically targeted IKEv2 hosts to confirm these results.
>
> Where hosts should respond once based on IKEv2 RFC specs, hundreds of thousands reply multiple times, roughly 110,000 reply 21 times or more per single
> probe, some of the worst offenders responded thousands of times.
>
Are you sure those replies did not come from IKEv1 servers that do not implement IKEv2 ? A bunch of implementations just copy the incoming header
to construct the outgoing header. You can detect this by sending an bogus IKEv3 packet and see if they reply the same to that.
Can you confirm your test actually got a valid IKE_INIT reply that was re-send multiple times? If so, can you detect the vendor behind it? I can probably help
fingerprint that to determine.
Paul
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
