FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2004-0155

This CVE name corresponds to:

Entered	Topic
2004-04-07	racoon fails to verify signature during Phase 1

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2004-0155 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2004-0155
Phase	Assigned(20040213)

Description

The KAME IKE Daemon Racoon, when authenticating a peer during Phase 1, validates the X.509 certificate but does not verify the RSA signature authentication, which allows remote attackers to establish unauthorized IP connections or conduct man-in-the-middle attacks using a valid, trusted X.509 certificate.

References

Source	Reference
BUGTRAQ	20040407 CAN-2004-0155: The KAME IKE Daemon Racoon does not verify RSA Signatures during Phase 1, allows man-in-the-middle attacks and unauthorized connections
GENTOO	GLSA-200406-17
MANDRAKE	MDKSA-2004:027
MANDRAKE	MDKSA-2004:069
APPLE	APPLE-SA-2004-05-03
REDHAT	RHSA-2004:165
SCO	SCOSA-2005.10
CERT-VN	VU#552398
BID	10072
OVAL	oval:org.mitre.oval:def:945
OVAL	oval:org.mitre.oval:def:9291
SECUNIA	11328