Description
The isakmp_info_recv function in src/racoon/isakmp_inf.c in racoon in Ipsec-tools before 0.6.7 allows remote attackers to cause a denial of service (tunnel crash) via crafted (1) DELETE (ISAKMP_NPTYPE_D) and (2) NOTIFY (ISAKMP_NPTYPE_N) messages.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | ipsec-tools | 1:0.6.6-3.1lenny1 | DTSA-42-1 |
| Debian 4.0 | ipsec-tools | 1:0.6.6-3.1etch1 | DSA-1299-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | ipsec-tools | 0.6.5-8.el5 | RHSA-2007:0342 |
Advisories 3
- RHSA-2007:0342 Red Hat Security Advisory: ipsec-tools security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DTSA-42-1 ipsec-tools - missing input sanitising Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1299-1 ipsec-tools Debian Security (DSA / DLA) · Mar 9, 2026
References
- oval:org.mitre.oval:def:10504 vdb-entry signature
- GLSA-200705-09 vendor-advisory
- 23394 vdb-entry
- ADV-2007-1310 vdb-entry
- 25322 third-party-advisory
- USN-450-1 vendor-advisory
- 24826 third-party-advisory
- MDKSA-2007:084 vendor-advisory
- ipsectools-isakmpinforecv-dos(33541) vdb-entry
- http://sourceforge.net/project/shownotes.php?release_id=499192&group_id=74601
- 24815 third-party-advisory
- 1018086 vdb-entry
- [Ipsec-tools-devel] 20070406 Ipsec-tools 0.6.7 released mailing-list
- 25560 third-party-advisory
- SUSE-SR:2007:008 vendor-advisory
- 24833 third-party-advisory
- DSA-1299 vendor-advisory
- RHSA-2007:0342 vendor-advisory
- 25072 third-party-advisory
- 25142 third-party-advisory