Description
IPSEC implementations including (1) FreeS/WAN and (2) KAME do not properly calculate the length of authentication data, which allows remote attackers to cause a denial of service (kernel panic) via spoofed, short Encapsulating Security Payload (ESP) packets, which result in integer signedness errors.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | freeswan | 1.96-1.4 | DSA-201 |
Advisories 1
- DSA-201 freeswan - denial of service Debian Security (DSA / DLA) · Mar 9, 2026
References
- 20021018 Denial of Service in IPSEC implementations vendor-advisory
- ipsec-packet-integer-overflow(10411) vdb-entry
- 6011 vdb-entry
- DSA-201 vendor-advisory
- VU#459371 third-party-advisory