CVE-2005-3674: High severity Sun Solaris vulnerability

Published Nov 18, 2005

Updated

The Internet Key Exchange version 1 (IKEv1) implementation in the libike library in Sun Solaris 9 and 10 allows remote attackers to cause a denial of service (in.iked crash) via certain crafted IKE packets, as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1. NOTE: due to the lack of details in the advisory, it is unclear which of CVE-2005-3666, CVE-2005-3667, and/or CVE-2005-3668 this issue applies to.

Affected Software

2 affected components

Sun Solaris=10.0

Sun Solaris=9.0

Event History

Nov 18, 2005

CVE Published

09:03 PM

Nov 19, 2005

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2005-3674?

CVE-2005-3674 is classified as a denial of service vulnerability affecting certain IKEv1 implementations.

How do I fix CVE-2005-3674?

To mitigate CVE-2005-3674, update your Sun Solaris systems to the latest available patches provided by Oracle.

What systems are affected by CVE-2005-3674?

CVE-2005-3674 affects Sun Solaris 9 and 10 running on SPARC architecture.

What kind of attack does CVE-2005-3674 facilitate?

CVE-2005-3674 allows remote attackers to cause a denial of service by sending crafted IKE packets.

Is there any public testing related to CVE-2005-3674?

Yes, the PROTOS ISAKMP Test Suite has demonstrated the vulnerability by testing IKEv1 implementations.