CVE-2004-0607: Critical severity Ipsec-tools Ipsec-tools vulnerability
Published Jun 30, 2004
·Updated
The eaycheckx509cert function in KAME Racoon successfully verifies certificates even when OpenSSL validation fails, which could allow remote attackers to bypass authentication.
Affected Software
17 affected components
Ipsec-tools Ipsec-tools=0.3
Ipsec-tools Ipsec-tools=0.3.1
Ipsec-tools Ipsec-tools=0.3.2
Ipsec-tools Ipsec-tools=0.3_rc1
Ipsec-tools Ipsec-tools=0.3_rc2
Ipsec-tools Ipsec-tools=0.3_rc3
Ipsec-tools Ipsec-tools=0.3_rc4
Ipsec-tools Ipsec-tools=0.3_rc5
KAME Racoon
KAME Racoon=2003-07-11
KAME Racoon=2004-04-05
KAME Racoon=2004-04-07b
KAME Racoon=2004-05-03
redhat Enterprise Linux=3.0
redhat Enterprise Linux=3.0
redhat Enterprise Linux=3.0
redhat Enterprise Linux Desktop=3.0
Remediation
Patch Available
Event History
Jun 30, 2004
CVE Published
via MITRE·08:00 AM
Data Sourced
via MITRE·08:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2004-0607?
CVE-2004-0607 is considered a critical vulnerability as it allows remote attackers to bypass authentication.
2
How do I fix CVE-2004-0607?
To fix CVE-2004-0607, update the affected KAME Racoon or Ipsec-tools software to a patched version.
3
What software is affected by CVE-2004-0607?
CVE-2004-0607 affects specific versions of KAME Racoon and Ipsec-tools including versions 0.3_rc1 through 0.3_rc5.
4
What are the risks associated with CVE-2004-0607?
The main risk of CVE-2004-0607 is the potential for unauthorized access to systems due to failed certificate validation.
5
Is CVE-2004-0607 a known issue in older systems?
Yes, CVE-2004-0607 is a known issue impacting older systems using KAME Racoon and certain Ipsec-tools versions.