Bug 967611 (VU#419128) - VUL-1: VU#419128: IKE DoS tracker-bug
Summary: VUL-1: VU#419128: IKE DoS tracker-bug
Status: RESOLVED DUPLICATE of bug 984628
Alias: VU#419128
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P4 - Low : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-02-22 11:08 UTC by Sebastian Krahmer
Modified: 2016-06-16 14:51 UTC (History)
4 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
attached PDF (421.13 KB, application/pdf)
2016-02-22 11:11 UTC, Sebastian Krahmer 		Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Comment 2 Swamp Workflow Management 2016-02-22 23:00:17 UTC 
bugbot adjusting priority
Comment 3 Marcus Meissner 2016-04-04 13:19:55 UTC 
https://www.kb.cert.org/vuls/id/419128  seems public
Comment 5 Marcus Meissner 2016-04-04 14:16:40 UTC 
no cve

from note:

Vulnerability Note VU#419128
IKE/IKEv2 protocol implementations may allow network amplification attacks

Original Release date: 29 Feb 2016 | Last revised: 04 Mar 2016
Print Document
Tweet
Like Me
Share
Overview

Implementations of the IKEv2 protocol are vulnerable to network amplification attacks.
Description

CWE-406: Insufficient Control of Network Message Volume (Network Amplification)

IKE/IKEv2 and other UDP-based protocols can be used to amplify denial-of-service attacks. In some scenarios, an amplification of up to 900% may be obtained from IKEv2 server implementations.

More details are provided in a white paper from the researcher.
Impact

An unauthenticated remote attacker may leverage the vulnerable IKE/IKEv2 server to conduct a distributed reflective denial-of-service (DRDoS) attack on another user.
Solution

The CERT/CC is currently unaware of a full solution to this problem.

Please consider one of the workarounds listed below.

A full solution may require revisions to RFC 7296 and/or RFC 2408.

Perform Egress Filtering

Configure your router/firewall to perform egress filtering, which may help to mitigate attacks that utilize source IP spoofing. Please refer to your product's documentation for instructions on how to perform egress filtering.
Comment 6 Marcus Meissner 2016-06-16 14:51:11 UTC 
i opened a newer bug, use that for tracking

*** This bug has been marked as a duplicate of bug 984628 ***