Description
The eay_check_x509cert function in KAME Racoon successfully verifies certificates even when OpenSSL validation fails, which could allow remote attackers to bypass authentication.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | ipsec-tools | 0.2.5-0.5 | RHSA-2004:308 |
Advisories 1
- RHSA-2004:308 Red Hat Security Advisory: ipsec-tools security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- 20040615 Re: authentication bug in KAME's racoon mailing-list
- http://sourceforge.net/project/shownotes.php?release_id=245982
- 7113 vdb-entry
- 11877 third-party-advisory
- 20040614 authentication bug in KAME's racoon mailing-list
- racoon-eaycheckx509cert-auth-bypass(16414) vdb-entry
- RHSA-2004:308 vendor-advisory
- oval:org.mitre.oval:def:9163 vdb-entry signature
- 1010495 vdb-entry
- 11863 third-party-advisory
- 10546 vdb-entry
- GLSA-200406-17 vendor-advisory