VPN Flaw Allows Denial of Service

An anonymous reader writes "Finnish researchers at the University of Oulu have found a vulnerability in ISAKMP (Internet Security Association and Key Management Protocol) -- the technology used in IPsec virtual private network and firewall products from a range of networking companies, including Cisco and Juniper Networks. Cisco said the security flaw could cause devices to reset over and over, which could cause a temporary denial-of-service attack. It did not mention the possibility of the device being taken over by an intruder, while Juniper said it has been aware of the problem since June, so software issued on or after July 28 provide fixes for the flaw."

Comments

Original publication

[Anonymous Coward]

http://www.ee.oulu.fi/research/ouspg/protos/testin g/c09/isakmp/index.html

"ABSTRACT

The Internet Security Association and Key Management Protocol (ISAKMP), is designed to establish, negotiate, modify and delete Security Associations. ISAKMP provides a consistent framework for transferring key and authentication data which is independent of the key generation technique, encryption algorithm and authentication mechanism. Internet Key Exchange (IKE), a derivate of ISAKMP, is a key protocol in the Internet Security Architecture (IPsec). A subset of IKE Phase 1 negotiation was chosen as the subject protocol for vulnerability assessment through syntax testing and test-suite creation. A survey of the related standards was made. Test-material was prepared and tests were carried out against a sample set of existing implementations. Results were gathered and reported. Some of the implementations available for evaluation failed to perform in a robust manner under the test. Some failures had information security implications, and should be considered as vulnerabilities. Therefore, this robustness test-material should be adopted for evaluation and development of ISAKMP/IKE products."

Try again.

[piranha(jpl)]

FTFA:

Multiple ISAKMP implementations behave in anomalous way when they receive and handle ISAKMP Phase 1 packets with invalid and/or abnormal contents. By applying the OUSPG PROTOS ISAKMP Test Suite to a variety of products, several vulnerabilities can be revealed that can have varying effects.

That doesn't strike me as a protocol problem.

Re:This seems like a protocol issue

[Homology]

and not an implementation failure. So how exactly are individual vendors patching it without changing the protocol? Or are they making changes in the protocol that would be "invisible" to the outside world?

The advisory says:

Multiple ISAKMP implementations behave in anomalous way when they receive and handle ISAKMP Phase 1 packets with invalid and/or abnormal contents. By applying the OUSPG PROTOS ISAKMP Test Suite to a variety of products, several vulnerabilities can be revealed that can have varying effects.

The OpenBSD developers fixed this early 2004 :

> I just tested our isakmpd(8) implementation against the PROTOS
> test suite. No problems were detected. We performed an audit
> of isakmpd's IKE parsing code back in early 2004 and made several
> fixes (OpenBSD 3.4 timeframe).
>
> I also ran the PROTOS suite against tcpdump -vvv and saw no
> problems.

Please also note that both these programs are priv sep'd, so that
in the event a bug is found, the impact will be much reduced.

Looks like implementation

[mikeborella]

Some lab ran a protocol tester against some ISAKMP implementations and found a few issues. No reason to panic as long as the vendors fix it. It is pretty common to fix these sorts of bugs it complicated protocols like ISAKMP.

Re:OpenBSD?

[Anonymous Coward]

It was and fixed it in OpenBSD 3.4 which was released early 2004.

Now almost 2 years latter, I am lost for words.

Re:Well, I knew something was up...

[forged]

No free software upgrade ?

From the Cisco security advisory:

Summary

Multiple Cisco products contain vulnerabilities in the processing of IPSec IKE (Internet Key Exchange) messages. These vulnerabilities were identified by the University of Oulu Secure Programming Group (OUSPG) "PROTOS" Test Suite for IPSec and can be repeatedly exploited to produce a denial of service.

Cisco has made free software available to address this vulnerability for affected customers. Prior to deploying software, customers should consult their maintenance provider or check the software for feature set compatibility and known issues specific to their environment. (emphasis mine)

Then later in the same document, there's a whole section about Obtaining Fixed Software including a subsection for Customers without Service Contracts (emphasis mine) which I assume is your case.

CheckPoint's Reply

[xaosflux]

From CheckPoint Solutions:
Solution ID: #sk31316
Product: VPN-1/FireWall-1
Version: NG AI, NGX
Last Modified: 14-Nov-2005

Symptoms
On Monday, November 14th, NISCC has issued a warning about a possible denial of service condition for IKEv1. No known exploit exists.
(NISCC Vulnerability Advisory 273756)

Cause
This issue was identified using the PROTOS ISAKMP Test Suite for IKEv1 which was published through NISCC.

The issue is due to a problem with the implementation of the IKE protocol.
The issue might cause a crash of the IKE daemon (vpnd) during the processing of IKE packet 5.

An attacker needs to perform a full IKE negotiation with the attacked VPN gateway in order to cause the denial of service condition; no single packet attack is possible.
No further exploit is possible.
There is no possibility of code execution relating to this issue.
Given the nature of the issue, crafting an exploit is extremely difficult.

Solution
Install the latest HFA (HotFix Accumulator)

Okey, soooo....

[Kalzus]

They tested a bunch of implementations and a bunch of them failed out over 5000 different tests. How is this a problem with the protocol itself as opposed to how a bunch of vendors decided to implement it?

Might've been better phrased if it read as a vulnerability with "a number of popular implementations of IKEv1" as opposed to a vulnerability with the protocol.