Paul Wouters

The issue causes libreswan to restart under some IKEv2 retransmit scenarios when a connection is configured to use PreSharedKeys (authby=secret) and the connection cannot find a matching configured secret. This can lead to repeated crashes and a Denial of Service, especially when such a connection is automatically added on startup using the auto= keyword. The vulnerability is related to the use of PreSharedKeys for creating the AUTH payload in IKE AUTH Exchange, allowing a remote attacker to perform a Denial of Service attack.

The issue allows remote attackers to cause a denial of service, resulting in an assert failure and daemon restart, via a crafted TS payload with an incorrect selector length. This is due to a missing check in the Traffic Selector parsing code that would reject malformed Traffic Selector payloads, leading to a double free and crash of the pluto daemon. It is noted that there is no remote code execution.

The issue is related to the lack of input data sanitization in the ipsec module of the Unbound DNS server, allowing a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. This can be triggered by a specially crafted IPSECKEY answer, but only if Unbound was compiled with `--enable-ipsecmod` support and ipsecmod is enabled and used in the configuration.

The issue allows remote attackers to cause a denial of service, resulting in an assertion failure and daemon restart. This occurs when a zero DH g^x value is present in a KE payload within an IKE packet. The affected software must be built with NSS for this issue to be exploitable.

The issue allows remote attackers to cause a denial of service, resulting in a NULL pointer dereference and IKE daemon restart, via IKEv2 packets that lack expected payloads. This problem exists due to an incomplete fix for a previous issue.

The issue allows remote attackers to cause a denial of service, resulting in a crash, by sending a specially crafted IKE packet with a small length value and either no version or an invalid major number.

The issue allows local users to obtain sensitive information about the rhncfg-client actions by reading the /var/log/rhncfg-actions file due to weak permissions.

The issue affects the confidentiality, integrity, and availability of protected information. It can be exploited remotely.