FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2008-3652

This CVE name corresponds to:

Entered Topic
2009-01-21 ipset-tools -- Denial of Service Vulnerabilities

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

Details

Type Candidate
Name CVE-2008-3652
Phase Assigned(20080812)

Description

src/racoon/handler.c in racoon in ipsec-tools does not remove an "orphaned ph1" (phase 1) handle when it has been initiated remotely, which allows remote attackers to cause a denial of service (resource consumption).

References

Source Reference
MLIST [ipsec-tools-devel] 20080811 [PATCH] Track and delete orphaned ph1s
CONFIRM http://support.apple.com/kb/HT3549
CONFIRM http://support.apple.com/kb/HT3639
APPLE APPLE-SA-2009-05-12
APPLE APPLE-SA-2009-06-17-1
GENTOO GLSA-200812-03
MANDRIVA MDVSA-2008:181
REDHAT RHSA-2008:0849
SUSE SUSE-SR:2008:025
SUSE SUSE-SR:2009:004
UBUNTU USN-641-1
CERT TA09-133A
BID 30657
OVAL oval:org.mitre.oval:def:10448
SECUNIA 35074
VUPEN ADV-2008-2844
VUPEN ADV-2008-2378
SECTRACK 1020692
SECUNIA 31478
SECUNIA 31624
SECUNIA 32759
SECUNIA 32971
VUPEN ADV-2009-1297
VUPEN ADV-2009-1621
XF ipsectools-orphanedph1-dos(44424)