CERTA-2002-AVI-261
Vulnerability from certfr_avis

L'implantation FreeS/WAN de Debian est vulnérable à une attaque de type déni de service.

Description

IPSec est un ensemble de mécanismes de sécurité pour le protocole IP. Natifs dans IPv6, ces mécanismes doivent être ajoutés aux piles IPv4.

FreeS/WAN est une implantation libre d'IPSec pour les systèmes Linux.

Sous Debian, FreeS/WAN ne traite pas correctement les paquets IP de petite taille. Cette vulnérabilité peut être exploitée pour provoquer une attaque de type déni de service.

Solution

Les versions 1.96-1.4 (Debian woody) et 1.99-1 (Debian sid) corrigent cette vulnérabilité.

None
Impacted products
Vendor Product Description
Debian N/A Debian instable (sid) : FreeS/WAN versions antérieures à la version 1.99-1.
Debian N/A Debian 3.0 (woody) : FreeS/WAN versions antérieures à la version 1.96-1.4 ;
References

Show details on source website


{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Debian instable (sid) : FreeS/WAN versions ant\u00e9rieures \u00e0 la version 1.99-1.",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Debian",
          "scada": false
        }
      }
    },
    {
      "description": "Debian 3.0 (woody) : FreeS/WAN versions ant\u00e9rieures \u00e0 la version 1.96-1.4 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Debian",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nIPSec est un ensemble de m\u00e9canismes de s\u00e9curit\u00e9 pour le protocole IP.\nNatifs dans IPv6, ces m\u00e9canismes doivent \u00eatre ajout\u00e9s aux piles IPv4.\n\nFreeS/WAN est une implantation libre d\u0027IPSec pour les syst\u00e8mes Linux.\n\nSous Debian, FreeS/WAN ne traite pas correctement les paquets IP de\npetite taille. Cette vuln\u00e9rabilit\u00e9 peut \u00eatre exploit\u00e9e pour provoquer\nune attaque de type d\u00e9ni de service.\n\n## Solution\n\nLes versions 1.96-1.4 (Debian woody) et 1.99-1 (Debian sid) corrigent\ncette vuln\u00e9rabilit\u00e9.\n",
  "cves": [],
  "initial_release_date": "2002-12-06T00:00:00",
  "last_revision_date": "2002-12-06T00:00:00",
  "links": [
    {
      "title": "Avis de s\u00e9curit\u00e9 Debian :",
      "url": "http://www.debian.org/security/2002/dsa-201"
    }
  ],
  "reference": "CERTA-2002-AVI-261",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2002-12-06T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service"
    }
  ],
  "summary": "L\u0027implantation FreeS/WAN de Debian est vuln\u00e9rable \u00e0 une attaque de type\nd\u00e9ni de service.\n",
  "title": "Vuln\u00e9rabilit\u00e9 de FreeS/WAN sous Debian",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Avis de s\u00e9curit\u00e9 Debian DSA 201-1",
      "url": null
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.


Loading…

Loading…

Loading…

Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.


Loading…

Loading…