CVE-2016-10396

High

Published: 06/07/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The racoon daemon in IPsec-Tools 0.8.2 contains a remotely exploitable computational-complexity attack when parsing and storing ISAKMP fragments. An attacker can exhaust computational resources on the remote endpoint by repeatedly sending ISAKMP fragment packets in a specific order.

Risk Assessment

This vulnerability can lead to denial of service on the remote server, affecting the availability of IPsec services within the organization.

Recommendation

It is recommended to upgrade to a newer version of IPsec-Tools that addresses this vulnerability and to monitor network traffic for potential attacks.

Other vulnerabilities in IPsec-Tools 0.8.2

CVE-2015-4047High
In IPsec-Tools version 0.8.2, a vulnerability allows remote attackers to cause the IKE daemon to crash by sending a series of crafted UDP requests, leading to a NULL pointer dereference.

Original NVD description (English source)

The racoon daemon in IPsec-Tools 0.8.2 contains a remotely exploitable computational-complexity attack when parsing and storing ISAKMP fragments. The implementation permits a remote attacker to exhaust computational resources on the remote endpoint by repeatedly sending ISAKMP fragment packets in a particular order such that the worst-case computational complexity is realized in the algorithm utilized to determine if reassembly of the fragments can take place.