freebsd security - Apr 2004 - Note to Racoon users (IKE/ISAKMP daemon)

As was accidently posted here earlier by Ralf :-), you should be aware
of this issue:

http://vuxml.freebsd.org/d8769838-8814-11d8-90d1-0020ed76ef5a.html

  racoon fails to verify signature during Phase 1

  Affected packages
    racoon < 20040407b

  Details

  VuXML ID  d8769838-8814-11d8-90d1-0020ed76ef5a
  Discovery 2004-04-05
  Entry     2004-04-07

  Ralf Spenneberg discovered a serious flaw in racoon. When using
  Phase 1 main or aggressive mode, racoon does not verify the client's
  RSA signature. Any installations using X.509 authentication are
  strongly urged to upgrade.

  Installations using pre-shared keys are believed to be unaffected.

  References

  CVE   CAN-2004-0155
  Name
  URL   http://www.kame.net/dev/cvsweb2.cgi/kame/kame/kame/racoon/
	crypto_openssl.c?rev=1.84&content-type=text/x-cvsweb-markup

-- 
Jacques Vidrine / nectar@celabo.org / jvidrine@verio.net / nectar@freebsd.org