Re: CVE Request: IKEv1 protocol is vulnerable to DoS amplification attack

["Seaman, Chad" <cseaman () akamai com>]

Hi All,

I’m Chad Seaman @ Akamai, the researcher who found, researched, and wrote the paper on the IKEv1 and IKEv2 flaws that 
could lead to amplification attacks.

The opening e-mail states that IKEv2 is not believed to be affected, I can confirm that in some cases some 
implementations are indeed affected.

There was some doubts about IKEv2 being affected and I was contacted by a Cisco engineer as well as one of the RFC 
authors, we constructed multiple IKEv2 probe payloads and did a series of secondary scans that specifically targeted 
IKEv2 hosts to confirm these results.

Where hosts should respond once based on IKEv2 RFC specs, hundreds of thousands reply multiple times, roughly 110,000 
reply 21 times or more per single probe, some of the worst offenders responded thousands of times.

Regards,
Chad


> On Jun 14, 2016, at 10:34 AM, Paul Wouters <pwouters () redhat com> wrote:
>
> On 06/13/2016 10:40 AM, cve-assign () mitre org wrote:
> > > Its not libreswan which is flawed, but its the protocol which they are trying to implement.
> >
> > > which implement IKEv1 are flawed, since they follow this protocol
> >
> > Many protocols could be described as "flawed." The IKEv1 protocol amplification concern does not make it flawed in a 
> > way that would lead to a per-protocol
> > CVE ID assignment.
>
> Then you should pull the CVE-2016-5361 which deals with retransmission amplification in IKEv1
>
> We are maintaining the
> > CVE-2016-5361 ID assignment for the upstream announcement of "libreswan 3.16 vulnerable to DDOS attack. Please 
> > upgrade to 3.17"
>
> That statement on the libreswan website is clearly referring to CVE-2016-3071 not CVE-2016-5361.
>
> and
> > accompanying upstream patch, as described in the http://www.openwall.com/lists/oss-security/2016/06/10/4 post.
>
> Which again clearly refers to CVE-2016-5361 and not CVE-2016-3071
>
> So again, please fix CVE-2016-5361 or drop it.
>
> Paul

Attachment: signature.asc
Description: Message signed with OpenPGP using GPGMail