[Security Announce] [ MDKSA-2007:084 ] - Updated ipsec-tools packages fix DoS vulnerability

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDKSA-2007:084
http://www.mandriva.com/security/
_______________________________________________________________________

Package : ipsec-tools
Date : April 16, 2007
Affected: 2007.0, 2007.1, Corporate 4.0, Multi Network Firewall 2.0
_______________________________________________________________________

Problem Description:

The ipsec-tools package prior to version 0.6.7 allows remote attackers
to cause a Denial of Service (tunnel crash) via crafted DELTE and
NOTIFY messages.

Updated packages have been patched to correct this issue.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1841
_______________________________________________________________________

Updated Packages:

Mandriva Linux 2007.0:
45dbff65f54ae18f638bd7ba0bbaf42e 2007.0/i586/ipsec-tools-0.6.6-2.1mdv2007.0.i586.rpm
e436d6c8455d234147142ae385b5257d 2007.0/i586/libipsec0-0.6.6-2.1mdv2007.0.i586.rpm
545ac1abb2e59ec822c5484e7ceb0164 2007.0/i586/libipsec0-devel-0.6.6-2.1mdv2007.0.i586.rpm
50d4165a6a97f09778011f33d6d44ca0 2007.0/SRPMS/ipsec-tools-0.6.6-2.1mdv2007.0.src.rpm

Mandriva Linux 2007.0/X86_64:
e2699ff4ac621bf8513a5fe08666a9ec 2007.0/x86_64/ipsec-tools-0.6.6-2.1mdv2007.0.x86_64.rpm
46ea919ab6e9df83a84b0a34928d65f4 2007.0/x86_64/lib64ipsec0-0.6.6-2.1mdv2007.0.x86_64.rpm
b36bd1ea7adc31f592eedb2abb5d33fc 2007.0/x86_64/lib64ipsec0-devel-0.6.6-2.1mdv2007.0.x86_64.rpm
50d4165a6a97f09778011f33d6d44ca0 2007.0/SRPMS/ipsec-tools-0.6.6-2.1mdv2007.0.src.rpm

Mandriva Linux 2007.1:
a1fe5334c70d983076d28689277c5968 2007.1/i586/ipsec-tools-0.6.6-2.1mdv2007.1.i586.rpm
8bee44d6e3f2248634d15cb1370b4f6e 2007.1/i586/libipsec0-0.6.6-2.1mdv2007.1.i586.rpm
b06ab01becf6435a4c24c1a0434f062b 2007.1/i586/libipsec0-devel-0.6.6-2.1mdv2007.1.i586.rpm
ea4a41f7bc9fcbdff99ece8d87701b46 2007.1/SRPMS/ipsec-tools-0.6.6-2.1mdv2007.1.src.rpm

Mandriva Linux 2007.1/X86_64:
e825119d669cc71752c766e43e90eae9 2007.1/x86_64/ipsec-tools-0.6.6-2.1mdv2007.1.x86_64.rpm
ca27f136089ae600bea5ee00aeda0ce6 2007.1/x86_64/lib64ipsec0-0.6.6-2.1mdv2007.1.x86_64.rpm
954f74bc941fa199a619ba265e78097c 2007.1/x86_64/lib64ipsec0-devel-0.6.6-2.1mdv2007.1.x86_64.rpm
ea4a41f7bc9fcbdff99ece8d87701b46 2007.1/SRPMS/ipsec-tools-0.6.6-2.1mdv2007.1.src.rpm

Corporate 4.0:
be76171c672159b4f0f816c1ec5aab11 corporate/4.0/i586/ipsec-tools-0.6.5-2.1.20060mlcs4.i586.rpm
076f5b9d0411a3f4632f4e981a26b3b7 corporate/4.0/i586/libipsec0-0.6.5-2.1.20060mlcs4.i586.rpm
acce65810ca8328bca7e0286056f34f3 corporate/4.0/i586/libipsec0-devel-0.6.5-2.1.20060mlcs4.i586.rpm
1b91757b0c1f4e39eb5d3737f232fb68 corporate/4.0/SRPMS/ipsec-tools-0.6.5-2.1.20060mlcs4.src.rpm

Corporate 4.0/X86_64:
d5ebff7776ab22fe09cf688d590697a3 corporate/4.0/x86_64/ipsec-tools-0.6.5-2.1.20060mlcs4.x86_64.rpm
ead3bf23ba08bd776595053e8f3b8585 corporate/4.0/x86_64/lib64ipsec0-0.6.5-2.1.20060mlcs4.x86_64.rpm
c743b116469e8443a14ce40d8549f26c corporate/4.0/x86_64/lib64ipsec0-devel-0.6.5-2.1.20060mlcs4.x86_64.rpm
1b91757b0c1f4e39eb5d3737f232fb68 corporate/4.0/SRPMS/ipsec-tools-0.6.5-2.1.20060mlcs4.src.rpm

Multi Network Firewall 2.0:
9d15b12b6265294254c4395d576af399 mnf/2.0/i586/ipsec-tools-0.2.5-0.4.M20mdk.i586.rpm
9f1baa807c3f8c2fce15c51799d371d4 mnf/2.0/i586/ipsec-tools-0.2.5-0.5.M20mdk.i586.rpm
438f827336c17aad6d6639e968d754b4 mnf/2.0/i586/libipsec-tools0-0.2.5-0.5.M20mdk.i586.rpm
eec95352e1b736a90f86c580925bcb8c mnf/2.0/SRPMS/ipsec-tools-0.2.5-0.5.M20mdk.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
lt;security*mandriva.comgt;
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)

iD8DBQFGI8kTmqjQ0CJFipgRAn+GAJ99POpenumSnklSrGeqjk2WuOcTEgCgnPjr
d13W58lzCc6927VxZiwB+D0=
=XpwK
-----END PGP SIGNATURE-----