The racoon daemon in IPsec-Tools 0.8.2 contains a remotely exploitable computational-complexity attack when parsing and storing ISAKMP fragments. The implementation permits a remote attacker to exhaust computational resources on the remote endpoint by repeatedly sending ISAKMP fragment packets in a particular order such that the worst-case computational complexity is realized in the algorithm utilized to determine if reassembly of the fragments can take place.
CVSS Details
- CVSS 3.0 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade ipsec-tools | Feb 25, 2019 | Jul 5, 2017 |
| Freebsd | — | Upgrade ipsec-tools | Apr 19, 2018 | Apr 14, 2018 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Dec 2, 2016 |
| Suse | — | Upgrade ipsec-tools | Feb 14, 2018 | Jul 5, 2017 |
| Ubuntu | — | Upgrade ipsec-toolsUpgrade racoon | Nov 16, 2017 | Jul 5, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub