REDHAT-BUG-497990: Null Pointer Dereference
First published: Tue Apr 28 2009(Updated: )
ipsec-tools upstream version 0.7.2 announcement mentions following security fix: o Fix a remote crash in fragmentation code <a href="http://sourceforge.net/project/shownotes.php?group_id=74601&release_id=677611">http://sourceforge.net/project/shownotes.php?group_id=74601&release_id=677611</a> Upstream CVS commit provides further details: From Neil Kettle: Fix a possible null pointer dereference in fragmentation code. <a href="http://cvsweb.netbsd.org/bsdweb.cgi/src/crypto/dist/ipsec-tools/src/racoon/isakmp_frag.c?f=h#rev1.4.6.1">http://cvsweb.netbsd.org/bsdweb.cgi/src/crypto/dist/ipsec-tools/src/racoon/isakmp_frag.c?f=h#rev1.4.6.1</a> <a href="http://cvsweb.netbsd.org/bsdweb.cgi/src/crypto/dist/ipsec-tools/src/racoon/isakmp_frag.c.diff?r1=1.4&r2=1.4.6.1&f=h">http://cvsweb.netbsd.org/bsdweb.cgi/src/crypto/dist/ipsec-tools/src/racoon/isakmp_frag.c.diff?r1=1.4&r2=1.4.6.1&f=h</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Ipsec-tools |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://sourceforge.net/project/shownotes.php?group_id=74601&release_id=677611
- http://cvsweb.netbsd.org/bsdweb.cgi/src/crypto/dist/ipsec-tools/src/racoon/isakmp_frag.c?f=h#rev1.4.6.1
- http://cvsweb.netbsd.org/bsdweb.cgi/src/crypto/dist/ipsec-tools/src/racoon/isakmp_frag.c.diff?r1=1.4&r2=1.4.6.1&f=h
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=497990#c1
- http://admin.fedoraproject.org/updates/ipsec-tools-0.7.2-1.fc9
- http://admin.fedoraproject.org/updates/ipsec-tools-0.7.2-1.fc10
- http://admin.fedoraproject.org/updates/ipsec-tools-0.7.2-1.fc11
- https://access.redhat.com/security/cve/CVE-2009-1574
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1574
- https://rhn.redhat.com/errata/RHSA-2009-1036.html
- https://bugzilla.redhat.com/show_bug.cgi?id=497990
Frequently Asked Questions
What is the severity of REDHAT-BUG-497990?
The severity of REDHAT-BUG-497990 is considered high due to the potential for a remote crash in the fragmentation code.
How do I fix REDHAT-BUG-497990?
To fix REDHAT-BUG-497990, upgrade to the latest version of ipsec-tools that includes the security fix.
What systems are affected by REDHAT-BUG-497990?
REDHAT-BUG-497990 affects systems running ipsec-tools version 0.7.2 or earlier.
What type of vulnerability is associated with REDHAT-BUG-497990?
REDHAT-BUG-497990 is associated with a remote code execution vulnerability that can lead to application crashes.
Is there a workaround for REDHAT-BUG-497990?
Currently, the recommended workaround for REDHAT-BUG-497990 is to disable the fragmentation feature in ipsec-tools until an update is applied.
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2009-1574
- agent/source
- agent/severity
- agent/references
- agent/weakness
- agent/description
- agent/event
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/ipsec-tools
- canonical/ipsec-tools ipsec-tools