CVE-2005-3671: High severity Frees Wan Frees Wan vulnerability
The Internet Key Exchange version 1 (IKEv1) implementation in Openswan 2 (openswan-2) before 2.4.4, and freeswan in SUSE LINUX 9.1 before 2.041.5.4-1.23, allow remote attackers to cause a denial of service via (1) a crafted packet using 3DES with an invalid key length, or (2) unspecified inputs when Aggressive Mode is enabled and the PSK is known, as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2005-3671?
CVE-2005-3671 has a severity rating that indicates it can lead to denial of service attacks.
How do I fix CVE-2005-3671?
To fix CVE-2005-3671, upgrade Openswan or FreeSwan to versions 2.4.4 or later.
What software is affected by CVE-2005-3671?
CVE-2005-3671 affects specific versions of Openswan prior to 2.4.4 and FreeSwan in SUSE LINUX 9.1 before 2.04_1.5.4-1.23.
What type of attack does CVE-2005-3671 enable?
CVE-2005-3671 enables remote attackers to exploit a denial of service vulnerability.
What causes the vulnerability in CVE-2005-3671?
The vulnerability in CVE-2005-3671 is caused by the IKEv1 implementation accepting crafted packets with invalid key lengths.