Re:IPsec Vulnerabilities and Software Security Prediction
by twunde on Tuesday May 19, 2015 @11:21AM
(#9570752)
FYI, this seems to affect some configurations but not all configurations. I've had one member of the NYC BSD group ran these against his IPSec configuration with just errors, but then set up a IPSec using the OP's configuration and was able to reproduce the coredumps.
[ Parent
| on HN ]
Re:IPsec Vulnerabilities and Software Security Prediction
by Javantea_ on Tuesday May 19, 2015 @03:36PM
(#9572568)
Thank you very much for testing this exploit. The vulnerability is in gssapi.c which is only compiled in if HAVE_GSSAPI is defined. This is an optional configuration parameter, so it sounds like the configuration you tested did not have GSSAPI/kerberos enabled. That's good news for users who have a similar setup, it will give them ample time to switch to a different IPsec implementation.