Openswan updates for vulnerabilities

NISTCC released this today, which doesn’t really tell you much. They contacted us about 4 months ago to report a vulernability, but wouldn’t tell us anything unless we signed an NDA. We refused - way too many issues with being unable to release/publish (Openswan is open source, so all commits are public) fixes until NISTCC decided it was okay. So we just knew there was a potential Denial of Service, maybe. One of our partners who did sign the NDA confirmed 2 bugs, but since we weren’t allowed to use the testsuite (covered by NISTCC’s NDA) we couldn’t confirm for ourselves, or confirm fixes.

The
PROTOS folks in Finland have now released thier paper, and included the isakmp testsuite so we’ve busy verifying fixes to the codebase. In the meantime, Openswan 2.4.2 is out with fixes for one of the two bugs. The other one requires aggressive mode, so it’s not nearly as widespread. We expect to have that fixed and 2.4.3 out by end of day.

Apparently we aren’t the only ones annoyed with NISTCC on this case - MITRE doesn’t have any CVE entries for this (yet)

Links:

November 14, 2005 · Filed Under Uncategorized

Comments

Comments are closed.