VPN Flaw Allows Denial of Service

An anonymous reader writes "Finnish researchers at the University of Oulu have found a vulnerability in ISAKMP (Internet Security Association and Key Management Protocol) -- the technology used in IPsec virtual private network and firewall products from a range of networking companies, including Cisco and Juniper Networks. Cisco said the security flaw could cause devices to reset over and over, which could cause a temporary denial-of-service attack. It did not mention the possibility of the device being taken over by an intruder, while Juniper said it has been aware of the problem since June, so software issued on or after July 28 provide fixes for the flaw."

Comments

This seems like a protocol issue

[Anonymous Coward]

and not an implementation failure. So how exactly are individual vendors patching it without changing the protocol? Or are they making changes in the protocol that would be "invisible" to the outside world?

Re:This seems like a protocol issue

[Homology]

and not an implementation failure. So how exactly are individual vendors patching it without changing the protocol? Or are they making changes in the protocol that would be "invisible" to the outside world?

The advisory says:

Multiple ISAKMP implementations behave in anomalous way when they receive and handle ISAKMP Phase 1 packets with invalid and/or abnormal contents. By applying the OUSPG PROTOS ISAKMP Test Suite to a variety of products, several vulnerabilities can be revealed that can have varying effects.

The OpenBSD developers fixed this early 2004 :

> I just tested our isakmpd(8) implementation against the PROTOS
> test suite. No problems were detected. We performed an audit
> of isakmpd's IKE parsing code back in early 2004 and made several
> fixes (OpenBSD 3.4 timeframe).
>
> I also ran the PROTOS suite against tcpdump -vvv and saw no
> problems.

Please also note that both these programs are priv sep'd, so that
in the event a bug is found, the impact will be much reduced.

Original publication

[Anonymous Coward]

http://www.ee.oulu.fi/research/ouspg/protos/testin g/c09/isakmp/index.html

"ABSTRACT

The Internet Security Association and Key Management Protocol (ISAKMP), is designed to establish, negotiate, modify and delete Security Associations. ISAKMP provides a consistent framework for transferring key and authentication data which is independent of the key generation technique, encryption algorithm and authentication mechanism. Internet Key Exchange (IKE), a derivate of ISAKMP, is a key protocol in the Internet Security Architecture (IPsec). A subset of IKE Phase 1 negotiation was chosen as the subject protocol for vulnerability assessment through syntax testing and test-suite creation. A survey of the related standards was made. Test-material was prepared and tests were carried out against a sample set of existing implementations. Results were gathered and reported. Some of the implementations available for evaluation failed to perform in a robust manner under the test. Some failures had information security implications, and should be considered as vulnerabilities. Therefore, this robustness test-material should be adopted for evaluation and development of ISAKMP/IKE products."

There is not a lot of info on NISCC site

[arivanov]

The blurb has nearly no meaningfull information whatsoever. The only meaningfull bit is the recommendation not to use aggressive mode.

Well... We kind'a all know this already. The weaknesses of agressive mode were all over BUGTRAQ more then 2 years ago and if you are still using it you "Get whatever Christmas you deserve".

Oh Cisco...

[emptycorp]

Gotta love a company that keeps administrators like me with job security :)

Try again.

[piranha(jpl)]

FTFA:

Multiple ISAKMP implementations behave in anomalous way when they receive and handle ISAKMP Phase 1 packets with invalid and/or abnormal contents. By applying the OUSPG PROTOS ISAKMP Test Suite to a variety of products, several vulnerabilities can be revealed that can have varying effects.

That doesn't strike me as a protocol problem.

There does not seem to be any IPsec exploiting

[pe1chl]

We have been running IPsec on Cisco routers for quite some time.
We have always had an explicit allow list for isakmp packets only for the known peers, and a deny with logging for all other sources.
Over the years, there have been only very few logged packets. No need to tell you how many NETBIOS and other wellknown exploitable service packets have been counted (we don't even log these).

It does not look like IPsec is a popular attack vector. Same for PPTP, by the way.

Thanks Jupiner!

[jacoplane]

"Juniper said it has been aware of the problem since June, so software issued on or after July 28 provide fixes for the flaw."

Gee, thanks for letting the rest of the world know too!

Summary

[hal9000(jr)]

Feed a server carefully crafted, malformed packets and it may behave in unpredictable ways. We show that several IPSec implementations of IKE V1 don't behave properly.

Not news kids, just development as usual.

Oh, and I like the bit about "possibly executing code." That, I believe, is FUD. Prove that you can execute code.

Looks like implementation

[mikeborella]

Some lab ran a protocol tester against some ISAKMP implementations and found a few issues. No reason to panic as long as the vendors fix it. It is pretty common to fix these sorts of bugs it complicated protocols like ISAKMP.

Re:Well, I knew something was up...

[forged]

No free software upgrade ?

From the Cisco security advisory:

Summary

Multiple Cisco products contain vulnerabilities in the processing of IPSec IKE (Internet Key Exchange) messages. These vulnerabilities were identified by the University of Oulu Secure Programming Group (OUSPG) "PROTOS" Test Suite for IPSec and can be repeatedly exploited to produce a denial of service.

Cisco has made free software available to address this vulnerability for affected customers. Prior to deploying software, customers should consult their maintenance provider or check the software for feature set compatibility and known issues specific to their environment. (emphasis mine)

Then later in the same document, there's a whole section about Obtaining Fixed Software including a subsection for Customers without Service Contracts (emphasis mine) which I assume is your case.