USN-641-1: Racoon vulnerabilities

Releases

• Ubuntu 8.04
• Ubuntu 7.10
• Ubuntu 7.04
• Ubuntu 6.06

Packages

• ipsec-tools -

Details

It was discovered that there were multiple ways to leak memory during the
IKE negotiation when handling certain packets. If a remote
attacker sent repeated malicious requests, the "racoon" key exchange
server could allocate large amounts of memory, possibly leading to a
denial of service.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 8.04

• racoon - 1:0.6.7-1.1ubuntu1.1

Ubuntu 7.10

• racoon - 1:0.6.6-3.1ubuntu3.1

Ubuntu 7.04

• racoon - 1:0.6.6-3ubuntu3.1

Ubuntu 6.06

• racoon - 1:0.6.5-4ubuntu1.2

In general, a standard system upgrade is sufficient to effect the
necessary changes.

References

• CVE-2008-3652
• CVE-2008-3651