CVE-2004-0219

Vulnerability

isakmpd in OpenBSD 3.4 and earlier (including -current as of March 17, 2004) contains a flaw in its handling of ISAKMP packets with a malformed Security Association payload. The daemon reads out of bounds when processing such payloads, leading to a crash. [1][2]

Exploitation

An unauthenticated remote attacker can send a specially crafted ISAKMP packet containing a malformed Security Association payload. No prior authentication or network position beyond network access is required. The Striker ISAKMP Protocol Test Suite demonstrated the attack. [1][2]

Impact

Successful exploitation causes the isakmpd daemon to crash, resulting in a denial of service. Subsequent IPsec-enabled communications may be disrupted until the daemon is restarted. [2]

Mitigation

OpenBSD has released patches for -current, 3.4-stable, and 3.3-stable. Users should apply the patch from the vendor's errata page [1][3]. The upcoming OpenBSD 3.5 will include privilege separation to lessen impact of future vulnerabilities. [1]