-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDVSA-2009:112
http://www.mandriva.com/security/
_______________________________________________________________________
Package : ipsec-tools
Date : May 13, 2009
Affected: 2008.1, 2009.0, 2009.1, Corporate 4.0
_______________________________________________________________________
Problem Description:
racoon/isakmp_frag.c in ipsec-tools before 0.7.2 allows remote
attackers to cause a denial of service (crash) via crafted fragmented
packets without a payload, which triggers a NULL pointer dereference
(CVE-2009-1574).
Updated packages are available that brings ipsec-tools to version
0.7.2 for Mandriva Linux 2008.1/2009.0/2009.1 which provides numerous
bugfixes over the previous 0.7.1 version, and also corrects this
issue. ipsec-tools for Mandriva Linux Corporate Server 4 has been
patched to address this issue.
Additionally the flex package required for building ipsec-tools has
been fixed due to ipsec-tools build problems and is also available
with this update.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1574
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2008.1:
d9878eb00cd2eab1ddab465ae1cc77d4 2008.1/i586/flex-2.5.33-3.1mdv2008.1.i586.rpm
9f806b3e098e21f478cbe7b342c4788d 2008.1/i586/ipsec-tools-0.7.2-0.1mdv2008.1.i586.rpm
417be6a91d0f9959adde599b31281e18 2008.1/i586/libipsec0-0.7.2-0.1mdv2008.1.i586.rpm
ddea0f917e8c20428f8f82e6bc5fc84f 2008.1/i586/libipsec-devel-0.7.2-0.1mdv2008.1.i586.rpm
2df69acaabd5b1bd4ae9559b50a2fe38 2008.1/SRPMS/flex-2.5.33-3.1mdv2008.1.src.rpm
073dd7f429789e991ce2140ae94dc9e3 2008.1/SRPMS/ipsec-tools-0.7.2-0.1mdv2008.1.src.rpm
Mandriva Linux 2008.1/X86_64:
7540e1692e011f5751b70ca5f813d30e 2008.1/x86_64/flex-2.5.33-3.1mdv2008.1.x86_64.rpm
e3b5eaafbfbb853fc8570b57bd24ca8f 2008.1/x86_64/ipsec-tools-0.7.2-0.1mdv2008.1.x86_64.rpm
bed8cf24ce2d9f7e0762330f03fe9f77 2008.1/x86_64/lib64ipsec0-0.7.2-0.1mdv2008.1.x86_64.rpm
6d9a2a1a75c2541556c8961f50a8db44 2008.1/x86_64/lib64ipsec-devel-0.7.2-0.1mdv2008.1.x86_64.rpm
2df69acaabd5b1bd4ae9559b50a2fe38 2008.1/SRPMS/flex-2.5.33-3.1mdv2008.1.src.rpm
073dd7f429789e991ce2140ae94dc9e3 2008.1/SRPMS/ipsec-tools-0.7.2-0.1mdv2008.1.src.rpm
Mandriva Linux 2009.0:
ed0510b3f70d276a944a1d08dd2d8cc1 2009.0/i586/flex-2.5.35-2.1mdv2009.0.i586.rpm
05d955250a465bf3db080b3030601169 2009.0/i586/ipsec-tools-0.7.2-0.1mdv2009.0.i586.rpm
ced5cda86b12e2fab5c1bbcccda4712f 2009.0/i586/libipsec0-0.7.2-0.1mdv2009.0.i586.rpm
7dc487599f48ba11d5ce532949854afd 2009.0/i586/libipsec-devel-0.7.2-0.1mdv2009.0.i586.rpm
d2f12938586e4487a63cd930b8766f3c 2009.0/SRPMS/flex-2.5.35-2.1mdv2009.0.src.rpm
151ae87db743b0cae0eaa30edd4bf0db 2009.0/SRPMS/ipsec-tools-0.7.2-0.1mdv2009.0.src.rpm
Mandriva Linux 2009.0/X86_64:
11f863a96976eae23b36b2d84b88bc05 2009.0/x86_64/flex-2.5.35-2.1mdv2009.0.x86_64.rpm
171ef0199e2cb79c5c8e9577fd4eab0b 2009.0/x86_64/ipsec-tools-0.7.2-0.1mdv2009.0.x86_64.rpm
9e30ebce0b6cda0ca64282e84e19bab7 2009.0/x86_64/lib64ipsec0-0.7.2-0.1mdv2009.0.x86_64.rpm
d94c59428164d08cc73a65b45a936b89 2009.0/x86_64/lib64ipsec-devel-0.7.2-0.1mdv2009.0.x86_64.rpm
d2f12938586e4487a63cd930b8766f3c 2009.0/SRPMS/flex-2.5.35-2.1mdv2009.0.src.rpm
151ae87db743b0cae0eaa30edd4bf0db 2009.0/SRPMS/ipsec-tools-0.7.2-0.1mdv2009.0.src.rpm
Mandriva Linux 2009.1:
e99fc0e432bcf6d8d6bda9099ebf1fe5 2009.1/i586/flex-2.5.35-3.1mdv2009.1.i586.rpm
7e91d7a68657858af9c54a12c4fb8464 2009.1/i586/ipsec-tools-0.7.2-0.1mdv2009.1.i586.rpm
8dd23d6335cf66b6fd3dad3695450495 2009.1/i586/libipsec0-0.7.2-0.1mdv2009.1.i586.rpm
75ba0568d29e9c5963f6d0a829dd5399 2009.1/i586/libipsec-devel-0.7.2-0.1mdv2009.1.i586.rpm
1179bd2ca09c92a74c53dd968d42dd41 2009.1/SRPMS/flex-2.5.35-3.1mdv2009.1.src.rpm
27805cc0683e81278c07ad042cd699f6 2009.1/SRPMS/ipsec-tools-0.7.2-0.1mdv2009.1.src.rpm
Mandriva Linux 2009.1/X86_64:
b6cfd4de694b49af45bb4a393d442132 2009.1/x86_64/flex-2.5.35-3.1mdv2009.1.x86_64.rpm
34542c4ab11123ca26d66d54f20b7785 2009.1/x86_64/ipsec-tools-0.7.2-0.1mdv2009.1.x86_64.rpm
cfa784d23e7d386683129e12efe500a6 2009.1/x86_64/lib64ipsec0-0.7.2-0.1mdv2009.1.x86_64.rpm
cb931729a533fe7accbc894fe4417ed0 2009.1/x86_64/lib64ipsec-devel-0.7.2-0.1mdv2009.1.x86_64.rpm
1179bd2ca09c92a74c53dd968d42dd41 2009.1/SRPMS/flex-2.5.35-3.1mdv2009.1.src.rpm
27805cc0683e81278c07ad042cd699f6 2009.1/SRPMS/ipsec-tools-0.7.2-0.1mdv2009.1.src.rpm
Corporate 4.0:
7b0e5364626bc882bc3cdcd6b9c26f13 corporate/4.0/i586/ipsec-tools-0.6.5-2.3.20060mlcs4.i586.rpm
809b36a5a2edad597edd1249c0b5950c corporate/4.0/i586/libipsec0-0.6.5-2.3.20060mlcs4.i586.rpm
88949442ee4678ed0f6327d8427da16c corporate/4.0/i586/libipsec0-devel-0.6.5-2.3.20060mlcs4.i586.rpm
5039010d191736aa3657e5ce74f15b34 corporate/4.0/SRPMS/ipsec-tools-0.6.5-2.3.20060mlcs4.src.rpm
Corporate 4.0/X86_64:
835b82cd18e78f3562ceabcc58050226 corporate/4.0/x86_64/ipsec-tools-0.6.5-2.3.20060mlcs4.x86_64.rpm
a71843b2cd9c5d02875f9ba339ef8827 corporate/4.0/x86_64/lib64ipsec0-0.6.5-2.3.20060mlcs4.x86_64.rpm
35fe487a2bd39e5ddbbae5d4ff54a68e corporate/4.0/x86_64/lib64ipsec0-devel-0.6.5-2.3.20060mlcs4.x86_64.rpm
5039010d191736aa3657e5ce74f15b34 corporate/4.0/SRPMS/ipsec-tools-0.6.5-2.3.20060mlcs4.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iD8DBQFKCxJqmqjQ0CJFipgRAtNjAKDT/r7mDFhyggR83f/afoLepfmzSACg65He
U78jJGj2oohufDisddD5Y/o=
=pV+P
-----END PGP SIGNATURE-----
