Description
isakmpd in OpenBSD 3.8, 3.9, and possibly earlier versions, creates Security Associations (SA) with a replay window of size 0 when isakmpd acts as a responder during SA negotiation, which allows remote attackers to replay IPSec packets and bypass the replay protection.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | isakmpd | 20041012-1sarge1 | DSA-1175-1 |
Advisories 1
- DSA-1175-1 isakmpd Debian Security (DSA / DLA) · Mar 9, 2026
References
- [3.8] 20060825 013: SECURITY FIX: August 25, 2006 vendor-advisory
- 28194 vdb-entry
- openbsd-isakmpd-security-bypass(28645) vdb-entry
- 1016757 vdb-entry
- 21652 third-party-advisory
- DSA-1175 vendor-advisory
- 19712 vdb-entry
- 21905 third-party-advisory
- [3.9] 20060825 008: SECURITY FIX: August 25, 2006 vendor-advisory