Description
The Internet Key Exchange version 1 (IKEv1) implementation (isakmp_agg.c) in racoon in ipsec-tools before 0.6.3, when running in aggressive mode, allows remote attackers to cause a denial of service (null dereference and crash) via crafted IKE packets, as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | ipsec-tools | 1:0.5.2-1sarge1 | DSA-965-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | ipsec-tools | 0.3.3-6.rhel4.1 | RHSA-2006:0267 |
| RHEL 3 | ipsec-tools | 0.2.5-0.7.rhel3.3 | RHSA-2006:0267 |
Advisories 2
- RHSA-2006:0267 Red Hat Security Advisory: ipsec-tools security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-965-1 ipsec-tools - null dereference Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://cvs.sourceforge.net/viewcvs.py/ipsec-tools/ipsec-tools/src/racoon/isakmp_agg.c?r1=1.20.2.3&r2=1.20.2.4&diff_format=u
- oval:org.mitre.oval:def:9857 vdb-entry signature
- 18616 third-party-advisory
- http://www.niscc.gov.uk/niscc/docs/re-20051114-01014.pdf?lang=en
- 20210 third-party-advisory
- 15523 vdb-entry
- [ipsec-tools-devel] 20051120 Potential DoS fixed in ipsec-tools mailing-list
- 1015254 vdb-entry
- DSA-965 vendor-advisory
- 20051214 Re: [ GLSA 200512-04 ] Openswan, IPsec-Tools: Vulnerabilities in ISAK MP Protocol implementation mailing-list
- 18742 third-party-advisory
- GLSA-200512-04 vendor-advisory
- http://www.ee.oulu.fi/research/ouspg/protos/testing/c09/isakmp/
- RHSA-2006:0267 vendor-advisory
- 19833 third-party-advisory
- 17668 third-party-advisory
- FLSA-2006:190941 vendor-advisory
- 18115 third-party-advisory
- 17822 third-party-advisory
- USN-221-1 vendor-advisory
- MDKSA-2006:020 vendor-advisory
- 17980 third-party-advisory
- ADV-2005-2521 vdb-entry
- SUSE-SA:2005:070 vendor-advisory