|
|
| Problem Description |
A very serious security flaw was discovered by Ralf Spenneberg in
racoon, the IKE daemon of the KAME-tools. Racoon does not very the RSA
signature during phase one of a connection using either main or
aggressive mode. Only the certificate of the client is verified, the
certificate is not used to verify the client's signature.
All versions of ipsec-tools prior to 0.2.5 and 0.3rc5 are vulnerable
to this issue. The provided package updates ipsec-tools to 0.2.5.
| Updated Packages |
Mandrakelinux 10.0
5ccd56bb9dab0708be04d99e68ee636a 10.0/RPMS/ipsec-tools-0.2.5-0.1.100mdk.i586.rpm 60af7d28c135a27a4a7a6a7a340154db 10.0/RPMS/libipsec-tools0-0.2.5-0.1.100mdk.i586.rpm a19e2af746e74f53b9a2d8e8e949a58a 10.0/SRPMS/ipsec-tools-0.2.5-0.1.100mdk.src.rpm
| References |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0155
| Upgrade |
To upgrade automatically, use MandrivaUpdate.
| Verification |
Please verify the update prior to upgrading to ensure the integrity of the downloaded package. You can do this with the command :
rpm --checksig package.rpm
You can get the GPG public key of the Mandriva Security Team to verify the GPG signature of each RPM.
If you use MandrivaUpdate, the verification of md5 checksum and GPG signature is performed automatically for you.