Apple Computer Inc. Not Affected

Notified:  July 02, 2002 Updated: August 06, 2002

Status

Not Affected

Vendor Statement

Mac OS X and Mac OS X Server do not contain the vulnerability described in this report.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

Avaya Unknown

Notified:  July 03, 2002 Updated: August 13, 2002

Status

Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

Cisco Systems Inc. Affected

Notified:  May 08, 2002 Updated: August 09, 2002

Status

Affected

Vendor Statement

Please see http://www.cisco.com/warp/public/707/vpnclient-multiple-vuln-pub.shtml

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

According to the report, the Cisco VPN Client 3.5 running on Windows NT 4.0 SP6 contains two buffer overflows, one of which may be exploitable. In addition, the Client contains two denial-of-service conditions.

Clavister Not Affected

Updated:  September 05, 2002

Status

Not Affected

Vendor Statement

Clavister Firewall with VPN module: Not vulnerable. Clavister VPN Client: Not vulnerable.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

Cray Inc. Not Affected

Notified:  July 02, 2002 Updated: August 06, 2002

Status

Not Affected

Vendor Statement

Cray, Inc. is not vulnerable as there are no IKE implementations in any of its products.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

Data General Unknown

Notified:  July 02, 2002 Updated: July 03, 2002

Status

Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

Debian Unknown

Notified:  July 02, 2002 Updated: July 03, 2002

Status

Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

FreeBSD Not Affected

Notified:  July 02, 2002 Updated: September 05, 2002

Status

Not Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The isakmpd port is vulnerable: -----BEGIN PGP SIGNED MESSAGE----- FreeBSD-SN-02:05 Security Notice The FreeBSD Project Topic: security issues in ports Announced: 2002-08-28 I. Introduction Several ports in the FreeBSD Ports Collection are affected by security issues. These are listed below with references and affected versions. All versions given refer to the FreeBSD port/package version numbers. The listed vulnerabilities are not specific to FreeBSD unless otherwise noted. These ports are not installed by default, nor are they ``part of FreeBSD'' as such. The FreeBSD Ports Collection contains thousands of third-party applications in a ready-to-install format. FreeBSD makes no claim about the security of these third-party applications. See for more information about the FreeBSD Ports Collection. II. Ports Port name: acroread5 Affected: versions < acroread-5.06 Status: Fixed Insecure temporary file handling. The acrobatviewer, acroread4, ghostscript, gv, mgv and xpdf ports can also display PDF files. Port name: aide Affected: versions < aide-0.7_1 Status: Fixed The default aide.conf silently fails to check subdirectories, even though it appears to be configured to do so. Port name: apache+mod_ssl Affected: versions < 1.3.26+2.8.10 Status: Fixed A child process of the Apache server can crash if it receives a request for the contents of a directory in which a maliciously constructed .htaccess file has been placed. In the default configuration, another child will be spawned, and the crash will be logged. Therefore the bug should be insignificant for most users. Port name: bugzilla Affected: versions < bugzilla-2.14.2 Status: Fixed "Various security issues of varying importance." Port name: Canna Affected: versions < ja-Canna-3.5b2_3 Status: Fixed A remotely exploitable buffer overflow exists in the cannaserver daemon. Although previously corrected, the patch containing the correction was inadvertently removed from the port skeleton. Port name: ethereal Affected: versions < ethereal-0.9.6 Status: Fixed Buffer overflows in BGP, IS-IS, and WCP dissectors. Port name: fam Affected: versions < fam-2.6.8 Status: Fixed "Unprivileged users can potentially learn names of files that only users in root's group should be able to view." Port name: isakmpd Affected: versions < isakmpd-20020403_1 Status: Fixed ``Receiving IKE payloads out of sequence can cause isakmpd(8) to crash.'' Port name: irssi Affected: versions < irssi-0.8.5 Status: Fixed Maliciously long topic can crash program remotely. Port name: kdelibs2 and kdelibs3 Affected: versions < kdelibs2-2.2.2_1 versions < kdelibs3-3.0.2_4 Status: Fixed A man-in-the-middle attack is possible against Konqueror and other KDE applications which use SSL. Port name: krb5 Affected: versions < krb5-1.2.5_2 Status: Fixed Contains an overflow in Sun RPC XDR decoder. Port name: linux-netscape6, netscape7, linux-mozilla, and mozilla Affected: versions < mozilla-1.0_1,1 (mozilla) versions < linux-mozilla-1.1 (linux-mozilla) All versions (others) Status: Fixed (linux-mozilla and mozilla) Not fixed (others) Malicious Web pages or files can cause loss of X session. When the X server receives a request to display an enormously large scalable font, the server exits abruptly, killing all its clients. This has been confirmed only with XFree86 4.2.0, but there is evidence that XFree86 3.3.6, the X font server, and Xvnc behave the same way. Unpatched Netscape (major version 6 or 7) and Mozilla browsers do not limit the size of fonts which Web pages or files can specify, thus triggering the bug. Scalable fonts may be disabled as a workaround. Port name: mm Affected: versions < mm-1.2.0 Status: Fixed May allow the local Apache user to gain privileges via temporary files. Port name: mpack Affected: versions < mpack-1.5_2 Status: Fixed Buffer overflow which might be triggered when mpack is used to process data from a remote source (email, news, and so on). Port name: mozilla, linux-mozilla Affected: versions < mozilla-1.0.rc1_2,1 (mozilla) versions < linux-mozilla-1.0_1 (linux-mozilla) Status: Not fixed An overflow exists in the Chatzilla IRC client. It can cause Mozilla to crash even if the demonstration page does not cause the crash. According to Robert Ginda, the bug does not allow execution of malicious code. Port name: newsx Affected: versions < newsx-1.4.8 Status: Fixed Format string bug reported by Niels Heinen . Port name: openssh, openssh-portable Affected: versions < openssh-3.4 (openssh) versions < openssh-3.4p1 (openssh-portable) Status: Fixed Buffer overflow can lead to denial of service or root compromise. Port name: php Affected: versions mod_php4-4.2.0 and mod_php4-4.2.1 versions php4-4.2.0 and php4-4.2.1 Status: Fixed On i386 architecture, may be remotely crashed; on other architectures, may allow execution of arbitrary code with the privileges of the Web server by anyone who can send HTTP POST requests. Port name: linux-png and png Affected: versions < linux-png-1.0.14 versions < png-1.2.4 Status: Fixed Malformed images (for example, in Web pages) can cause applications to crash. Execution of malicious code may be possible. Port name: postgresql7 Affected: versions < postgresql7-7.2.2 Status: Fixed Multiple buffer overruns may allow execution of malicious code. Remote attack is possible only when the server is configured to accept TCP/IP connections, which is not the default. Port name: samba Affected: versions < samba-2.2.5 Status: Fixed Possible buffer overflow. Port name: squid24 Affected: versions < squid-2.4_10 Status: Fixed Buffer overflows may allow remote execution of code. Port name: super Affected: versions < super-3.20.0 Status: Fixed Local root exploit. Port name: webmin Affected: versions < webmin-0.990_3 Status: Fixed "If a webmin user is able to view print jobs, he can execute any command as root." Port name: zmailer Affected: versions < zmailer-2.99.51_1 Status: Fixed When using IPv6, a remote buffer overflow during the processing of the HELO command is possible. Reported by 3APA3A <3APA3A@SECURITY.NNOV.RU>. III. Upgrading Ports/Packages To upgrade a fixed port/package, perform one of the following: 1) Upgrade your Ports Collection and rebuild and reinstall the port. Several tools are available in the Ports Collection to make this easier. See: /usr/ports/devel/portcheckout /usr/ports/misc/porteasy /usr/ports/sysutils/portupgrade 2) Deinstall the old package and install a new package obtained from [i386] ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/All/ Packages are not automatically generated for other architectures at this time. FreeBSD Security Notices are communications from the Security Officer intended to inform the user community about potential security issues, such as bugs in the third-party applications found in the Ports Collection, which will not be addressed in a FreeBSD Security Advisory. Feedback on Security Notices is welcome at . -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (FreeBSD) iQCVAwUBPWz8glUuHi5z0oilAQGD3wP/XLvIayMoXfSUuuw4VVr84c3vqVk0t0rL qZmLe+GaQ6Z5Fu/DfEta3HXhAPrlZx6dMWQfAbhjSyLfW8RpVkBlhbKR2ZImiddz t2vz9LaADnWIdyRkI+4zpd9xIgpzB3MQwrkh6ZnnE3pqQ12S4TwfAKqwGm7DSShg Ymz4mxfkiug= =J67P -----END PGP SIGNATURE-----

FreeS/WAN Unknown

Updated:  May 15, 2002

Status

Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

F-Secure Unknown

Notified:  June 12, 2002 Updated: August 05, 2002

Status

Unknown

Vendor Statement

F-Secure is investigating this potential vulnerability in F-Secure VPN+ products. A status update will be posted to CERT on 2002-08-19. For further information, please contact F-Secure-VPN-Support@F-Secure.com.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

Fujitsu Not Affected

Notified:  July 02, 2002 Updated: August 12, 2002

Status

Not Affected

Vendor Statement

Regarding VU#287771, Fujitsu's UXP/V is not affected. UXP/V does not support IKE.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

Guardian Digital Inc. Unknown

Notified:  July 02, 2002 Updated: July 03, 2002

Status

Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

Hewlett-Packard Company Not Affected

Notified:  July 02, 2002 Updated: February 05, 2003

Status

Not Affected

Vendor Statement

Source: Hewlett-Packard Company Software Security Response Team cross reference id: SSRT2273 HP-UX - not vulnerable HP-MPE/ix - not vulnerable HP Tru64 UNIX - not vulnerable HP OpenVMS - not vulnerable HP NonStop Servers - not vulnerable To report potential security vulnerabilities in HP software, send an E-mail message to:

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

Hitachi Not Affected

Updated:  September 05, 2002

Status

Not Affected

Vendor Statement

We've checked up on our router (Hitachi,Ltd. GR2000 series) about VU#459371 and VU#287771. Our IPsec and IKE implemantations are NOT vulnerable.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

IBM Not Affected

Notified:  July 02, 2002 Updated: December 11, 2002

Status

Not Affected

Vendor Statement

IBM's AIX is not vulnerable to the issues discussed in CERT Vulnerability Note VU#287771.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

KAME Project Not Affected

Notified:  July 03, 2002 Updated: August 12, 2002

Status

Not Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

MandrakeSoft Unknown

Notified:  July 02, 2002 Updated: July 03, 2002

Status

Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

Microsoft Corporation Not Affected

Notified:  July 02, 2002 Updated: August 12, 2002

Status

Not Affected

Vendor Statement

Microsoft has conducted a thorough investigation based on this report. Microsoft products are not affected by this issue.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

NEC Corporation Not Affected

Notified:  July 02, 2002 Updated: June 24, 2003

Status

Not Affected

Vendor Statement

sent on April 3, 2002 [Server Products] EWS/UP 48 Series operating system - is NOT vulnerable because it does not support IKE. [Router Products] IX 5000 Series - is NOT vulnerable. IX 1000 / 2000 Series - is NOT vulnerable.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

NetBSD Not Affected

Notified:  July 02, 2002 Updated: September 05, 2002

Status

Not Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The isakmpd port is vulnerable: http://cvsweb.netbsd.org/bsdweb.cgi/pkgsrc/security/isakmpd/Makefile?rev=1.21&content-type=text/x-cvsweb-markup

NetScreen Affected

Updated:  February 05, 2003

Status

Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Network Associates Affected

Notified:  May 08, 2002 Updated: September 10, 2002

Status

Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

According to the report, PGPFreeware 7.03 running on Windows NT 4.0 SP6 appears to contain a buffer overflow. NAI has released a PGP Hotfix titled CERT-IKE-PGPHotfix20020807.zip that is available at the following location: http://www.nai.com/naicommon/download/upgrade/patches/patch-pgphotfix.asp

NIST Not Affected

Notified:  June 20, 2002 Updated: August 12, 2002

Status

Not Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

Nortel Networks Not Affected

Notified:  May 17, 2002 Updated: August 20, 2002

Status

Not Affected

Vendor Statement

The Contivity Platform, which consists of the:

  • Contivity 600/1500/1600/2000/2500/2600/4500/4600
  • Contivity 1010/1050/1100
  • Contivity 1700/2700
Contivity software releases 3.5 and beyond including the CVC Client is not affected by the issues identified in VU#287771.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

According to the report, the Nortel Extranet Access Client is not vulnerable.

OpenBSD Affected

Notified:  July 02, 2002 Updated: February 05, 2003

Status

Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

PGP Affected

Notified:  May 10, 2002 Updated: September 05, 2002

Status

Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

According to the report, PGPFreeware 7.03 running on Windows NT 4.0 SP6 appears to contain a buffer overflow. NAI has released a PGP Hotfix titled CERT-IKE-PGPHotfix20020807.zip that is available at the following location: http://www.nai.com/naicommon/download/upgrade/patches/patch-pgphotfix.asp

Red Hat Inc. Not Affected

Notified:  July 02, 2002 Updated: August 16, 2002

Status

Not Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

SafeNet Affected

Notified:  May 13, 2002 Updated: August 20, 2002

Status

Affected

Vendor Statement

Please see http://www.safenet-inc.com/knowledgebase/read_item.asp?ID=375

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Based on tests performed by the reporter, SafeNet VPN client software is vulnerable.

Sequent Unknown

Notified:  July 02, 2002 Updated: July 03, 2002

Status

Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

SGI Not Affected

Notified:  July 02, 2002 Updated: August 12, 2002

Status

Not Affected

Vendor Statement

SGI does not currently implement IKE in their products.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

SonicWALL Inc. Affected

Updated:  April 01, 2003

Status

Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

According to the release notes, SonicWALL firmware 6.4.0.1 addresses this issue.

Sony Corporation Unknown

Notified:  July 02, 2002 Updated: July 03, 2002

Status

Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

SSH Communications Security Not Affected

Notified:  June 12, 2002 Updated: August 12, 2002

Status

Not Affected

Vendor Statement

SSH Communications Security's products are not impacted by this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

Sun Microsystems Inc. Not Affected

Notified:  July 02, 2002 Updated: August 05, 2002

Status

Not Affected

Vendor Statement

The Solaris in.iked daemon for Internet Key Exchange (IKE) [new to Solaris 9] and the SunScreen 3.2 ss_iked daemon for Internet Key Exchange (IKE) are not vulnerable to the issues described in the report. Both IKE daemons do not implement aggressive mode and therefore the vulnerabilities described in this report do not affect the Sun IKE daemons, in.iked and ss_iked, both daemons reject the response packet immediately.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

SuSE Inc. Not Affected

Notified:  July 02, 2002 Updated: August 12, 2002

Status

Not Affected

Vendor Statement

We reviewed critical parts of pluto (the daemon handling IKE) such as the code responsible for assembling and parsing IKE packets. We found no overflows or other bugs which could have security impacts.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

The SCO Group (SCO Linux) Unknown

Notified:  July 02, 2002 Updated: July 03, 2002

Status

Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

Unisys Unknown

Notified:  July 02, 2002 Updated: July 03, 2002

Status

Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

Wind River Systems Inc. Unknown

Notified:  July 02, 2002 Updated: July 03, 2002

Status

Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

View all 38 vendors View less vendors