Bugzilla Bug 112568

New bug affecting at least one ipsec product offered by Gentoo

Reproducible: Always
Steps to Reproduce:
1.
2.
3.

openswan-1.x is not vulnerable.
openswan-2.4.1 and earlier are.
I am testing an openswan-2.4.2 ebuild and will upload shortly.

Reference:
http://lists.openswan.org/pipermail/dev/2005-November/001121.html

strongswan is not vulnerable.

Reference:
http://lists.strongswan.org/pipermail/users/2005-November/001191.html

ok, openswan-2.4.2 is in portage. need to get 2.4.2 stable on amd64 (i have
hardware) then i will remove 2.2.0 and mark 2.4.2 stable on x86 and amd64.
anyone on the amd64 team want to test as well?

all revisions of openswan are ~ppc so leaving that way. however, getting ppc
team member to test would be great as my ppc hardware is no longer running linux.

ok, just for those who may test, i am working on an openswan-2.4.3 ebuild as
there was an assert found when using a PSK+ID in aggressive mode. Just got the
info from kenb with xelerence and downloaded the new tarball. i'll put a note
here when it is in portage.

openswan-2.4.3 is in portage.

Arches please test and mark stable. 

Readding amd64. 

Is there is reason the KLIPS engine cannot be selected for 2.6? 
 
(IMHO) The KLIPS engine has some advantages when builing netfilter rules. 
 

Hopefully I'm not alone here, but could someone tell me how I can test this on
x86 to make sure it is not broken?  Upstream's wiki appears to be down.

Mark - i have already tested some on x86, but there are a number of scenarios.
You can look here: http://gentoo-wiki.com/HOWTO_OpenSwan_2.6_kernel for some info.

If you need further help, just find me on IRC.

Jay

*sigh*... openswan-2.4.4 is on it's way (as per kenb from xelerance). it has
more ddos fixes. i will post an update once it is released and i test/commit it
to portage.

Back to upstream waiting for 2.4.4 

2005-11-18 : Xelerance has released Openswan 2.4.4 that fixes the secound
vulnerability found by the NISCC Advisory 3756/NISCC/ISAKMP.

See http://www.openswan.org/niscc2/ and bump.

2.4.4 is now in portage. Unless we get a huge bug report, I plan on marking
this
stable on x86/amd64 and getting rid of 2.2.0 in 24 hours.

maintainer / x86 / amd64 teams: please mark 2.4.4 stable (if stable :) )

openswan-2.4.4 is now marked stable on x86 and amd64.

Ready for GLSA vote. I tend to vote yes, due to the original issue (3DES
crafted
packet with invalid keylength) rather than the additional lame ones (DoS if PSK
known and aggressive mode enabled, already vulnerable to MiM anyway)...

I tend to say yes, too

Yes please issue a GLSA

k, this is ready for GLSA then.

GLSA 200512-04