FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

ipsec -- reply attack vulnerability

Affected systems
6.0 <= FreeBSD < 6.0_6
5.4 <= FreeBSD < 5.4_13
5.3 <= FreeBSD < 5.3_28
4.11 <= FreeBSD < 4.11_16
4.10 <= FreeBSD < 4.10_22

Details

VuXML ID e50a7476-bb2d-11da-b2fb-000e0c2e438a
Discovery 2006-03-22
Entry 2006-03-24
Modified 2006-06-09

Problem Description

IPsec provides an anti-replay service which when enabled prevents an attacker from successfully executing a replay attack. This is done through the verification of sequence numbers. A programming error in the fast_ipsec(4) implementation results in the sequence number associated with a Security Association not being updated, allowing packets to unconditionally pass sequence number verification checks.

Impact

An attacker able to intercept IPSec packets can replay them. If higher level protocols which do not provide any protection against packet replays (e.g., UDP) are used, this may have a variety of effects.

Workaround

No workaround is available.

References

CVE Name CVE-2006-0905
FreeBSD Advisory SA-06:11.ipsec