|
While processing an IPSec datagram, many IPSec implementations do not properly calculate the length of the authentication data field for very small datagrams. This vulnerability report is based only on ESP IPSec packets for IPv4, but the reporting researcher suggests that the same issues are likely to also be found for AH and/or for IPv6 packets.
IPSec's ESP (Encapsulating Security Payload) protocol's authentication is based in part on a Security Association (SA). The size of the authentication data field will depend on the authentication algorithm used by the SA, but is usually 12 bytes or more. When an ESP packet arrives, the IPSec implementation looks up the relevant SA and attempts to verify the authentication data. The vulnerable IPSec implementations either fail to check for the presence of the auth data, or check incorrectly. Spoofing very short ESP packets with only 8 bytes of IP payload can cause the Integrity Check Value to be calculated for an overly large range of memory, resulting in an unsigned integer overflow. This can cause a kernel panic.
|
razor.bindview.com -
Bindview RAZOR
