Racoon contains a flaw that may allow a remote denial of service. The issue is triggered when sending a specially crafted ISAKMP packet containing an overly large length field, which causes the ISAKMP message to consume all available system resources, resulting in a loss of availability.

Upgrade to version 20040408a or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

• Bugtraq ID: 10172
• Secunia Advisory ID: 11410 14178
• ISS X-Force ID: 15893
• CVE ID: 2004-0403 (see also: NVD)
• OVAL ID: 984
• Other Advisory URL: ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.10/SCOSA-2005.10.txt http://www.vuxml.org/freebsd/ccd698df-8e20-11d8-90d1-0020ed76ef5a.html
• Vendor Specific Advisory URL: ftp://patches.sgi.com/support/free/security/advisories/20040506-01-U.asc http://lists.apple.com/archives/security-announce/2004/May/msg00000.html
  http://orange.kame.net/dev/query-pr.cgi?pr=610
  http://rhn.redhat.com/errata/RHSA-2004-165.html
  http://www.gentoo.org/security/en/glsa/glsa-200406-17.xml
  http://www.mandrakesoft.com/security/advisories?name=MDKSA-2004:069
• Vendor Specific News/Changelog Entry: http://sourceforge.net/project/shownotes.php?release_id=232288
• Vendor Specific Solution URL: http://www.kame.net/dev/cvsweb2.cgi/kame/kame/kame/racoon/isakmp.c.diff?r1=1.180&r2=1.181
• Vendor URL: http://www.kame.net/racoon/
• CIAC Advisory: o-138

• John Lampe - jwlampenessus.org - Tenable Security