CVE-2004-0220: Buffer Overflow
Published Mar 25, 2004
·Updated
isakmpd in OpenBSD 3.4 and earlier allows remote attackers to cause a denial of service via an ISAKMP packet with a malformed Cert Request payload, which causes an integer underflow that is used in a malloc operation that is not properly handled, as demonstrated by the Striker ISAKMP Protocol Test Suite.
Affected Software
1 affected component
OpenBSD OpenBSD<=3.4
Remediation
Patch Available
Event History
Mar 25, 2004
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2004-0220?
CVE-2004-0220 is classified as a denial of service vulnerability.
2
How do I fix CVE-2004-0220?
To mitigate CVE-2004-0220, upgrade to OpenBSD version 3.5 or later.
3
Who is affected by CVE-2004-0220?
CVE-2004-0220 affects OpenBSD versions up to and including 3.4.
4
What causes CVE-2004-0220?
CVE-2004-0220 is caused by a malformed Cert Request payload in ISAKMP packets that leads to an integer underflow.
5
Can CVE-2004-0220 be exploited remotely?
Yes, CVE-2004-0220 can be exploited remotely by attackers sending malicious ISAKMP packets.