Are they and Astaro using the same code base?
Could this happen to an Astaro firewall?
Date: Tue, 07 Oct 2003 16:01:48 +0200
From: Mikael Olsson
To: cfw-users@lists.clavister.com
Subject: [cfw-users] Security alert: Vulnerability in IPsec/IKE certificate
ASN.1 parser
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Clavister Security alert:
Vulnerability in IPsec/IKE certificate ASN.1 parser
[Note: Even if you do not use VPN functionality, you want to read this.
See the workarounds section for relevant info.]
Date public:
Tuesday 2003-10-07
Issue:
All VPN enabled firewalls that support certificate-based authentication
are vulnerable to a buffer overrun in the ASN.1 parser in the IKE code.
Impact:
If an IKE connection can be established to a VPN enabled firewall, the
firewall can be crashed. This normally leads to an automatic restart.
The full extent of the buffer overrun is not yet fully understood; for
the time being, Clavister assumes that it may be possible to take control
of the firewall itself. Initial observations however suggest that this
may be difficult.
Workaround:
- For firewalls that do not require VPN functionality: use a firewall
core that does not support IPsec VPNs ("-novpn" cores).
- For VPN gateways: disable the "IPsecBeforeRules" advanced setting and
add rules that allow IKE and IPsec (e.g. the "ipsec-suite" service)
only from known IP addresses.
This reduces the window of exposure until a patch can be installed.
It may indeed be a good idea to always restrict who may speak IPsec
to your VPN gateways, if possible.
Affects:
v8.00.00-8.00.06, v8.10.00-8.10.01 and v8.20.00.
Not affected:
- Non-VPN cores
- VPN cores that do not allow IKE traffic to the firewall
(double check IPsecBeforeRules setting!)
Fix:
Fixed in v8.00.07, v8.10.02, v8.20.01 and v8.30.00.
The following firewall cores are available for immediate download:
For the v8.0x series:
http://www.clavister.com/support/prerelease/cfw_8_00_07_pre002.eup
For the v8.1x series:
http://www.clavister.com/support/prerelease/cfw_8_10_02_pre003.eup
For the v8.2x series:
http://www.clavister.com/support/prerelease/cfw_8_20_01_pre005.eup
Use the "Clavister Upgrader" to unpack and verify the authenticity
of these files. If not already installed, it is available on your
install CD.
Inclusion in regular updates:
The fix is included in all the versions mentioned under "Fixed:".
These will be released as regular releases in a matter of days.
Reporting vulnerabilities to Clavister:
Please report vulnerabilities to using
PGP encryption: http://www.clavister.com/company/security-pgp-info.html
- --
Mikael Olsson, Clavister AB
Storgatan 12, Box 393, SE-891 28 ÖRNSKÖLDSVIK, Sweden
Phone: +46 (0)660 29 92 00 Mobile: +46 (0)70 26 222 05
Fax: +46 (0)660 122 50 WWW: http://www.clavister.com
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)
iD8DBQE/gsaKgOH+cUWky1MRAs2JAKCvoPjDS8xfG2T9fRlBVSXX31H2jwCgsCSS
/56Jk7x6IoWalyBD7ZAaDJc=
=JSAJ
-----END PGP SIGNATURE-----
_____________________________________________________
cfw-users mailing list, cfw-users@lists.clavister.com
Unsubscribing: mailto:cfw-users-request@lists.clavister.com?subject=unsubscribe
This thread was automatically locked due to age.
