-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
NetBSD Security Advisory 2006-011
=================================
Topic: IPSec replay attack
Version: NetBSD-current: source prior to March 23, 2006
NetBSD 3.0: affected
NetBSD 2.1: affected
NetBSD 2.0.*: affected
NetBSD 2.0: affected
Severity: Systems could be vulnerable to a replay attack
Fixed: NetBSD-current: March 23, 2006
NetBSD-3-0 branch: March 28, 2006
(3.0.1 will include the fix)
NetBSD-3 branch: March 28, 2006
NetBSD-2-1 branch: March 30, 2006
(2.1.1 will include the fix)
NetBSD-2-0 branch: March 30, 2006
(2.0.4 will include the fix)
NetBSD-2 branch: March 30, 2006
Abstract
========
A vulnerability was found in the fast_ipsec(4) stack that
renders the
IPSec anti-replay service ineffective under certain
circumstances.
If the upper layer protocol doesn't provide any anti-packet
replay
verification (for example, UDP) the system may be vulnerable
to a
replay attack.
This vulnerability has been assigned CVE reference
CVE-2006-0905.
Technical Details
=================
The anti-replay service specifies an algorithm for
preventing
injection of previously received packets from unknown
parties
(the replay attack).
Due to a programming error in the fast_ipsec(4) stack, the
Sequence
Number associated with a SA was not being updated, thus
allowing
packets to bypass any sequence verification check.
Solutions and Workarounds
=========================
The default configuration of NetBSD does not ship with
FAST_IPSEC enabled.
For all NetBSD versions, you need to obtain fixed kernel
sources,
rebuild and install the new kernel, and reboot the system.
The fixed source may be obtained from the NetBSD CVS
repository.
The following instructions briefly summarise how to upgrade
your
kernel. In these instructions, replace:
ARCH with your architecture (from uname -m), and
KERNCONF with the name of your kernel configuration file.
To update from CVS, re-build, and re-install the kernel:
# cd src
# cvs update -d -P sys/netipsec/xform_esp.c
# ./build.sh kernel=KERNCONF
# mv /netbsd /netbsd.old
# cp sys/arch/ARCH/compile/obj/KERNCONF/netbsd /netbsd
# shutdown -r now
For more information on how to do this, see:
http:
//www.NetBSD.org/guide/en/chap-kernel.html
Thanks To
=========
Pawel Jakub Dawidek is credited with the discovery of this
issue
The FreeBSD Project for initial notification via
FreeBSD-SA-06:11.ipsec
Rui Paulo for importing the fixes into NetBSD
Revision History
================
2006-04-12 Initial release
More Information
================
Advisories may be updated as new information becomes
available.
The most recent version of this advisory (PGP signed) can be
found at
ftp://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-S
A2006-011.txt.asc
Information about NetBSD and NetBSD security can be found at
http://www.NetBSD.org/
and http://www.NetBSD.or
g/Security/.
Copyright 2006, The NetBSD Foundation, Inc. All Rights
Reserved.
Redistribution permitted only in full, unmodified form.
$NetBSD: NetBSD-SA2006-011.txt,v 1.8 2006/04/12 22:53:07
adrianp Exp $
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (NetBSD)
iQCVAwUBRD2E3j5Ru2/4N2IFAQKr/AP+KIHPPTfJQPSJLlZvvvUgapbaPMTW
aC48
T2JwVcdQmxka8G36k/mKeI92Jenk63R557NEgtqUjEsDi+3862HcKQSXSd+J
zjfa
9Ec2ORyKlE/IRnsRtCb9NxjGqYg3I+ti8ENKs9lBqw4XJkcgDdkI0KJ8NWnK
nD0f
Rz6FoeFdYgc=
=PLJl
-----END PGP SIGNATURE-----
|