Unscored severity · published Nov 18, 2005
CVE-2005-3671
The Internet Key Exchange version 1 (IKEv1) implementation in Openswan 2 (openswan-2) before 2.4.4, and freeswan in SUSE LINUX 9.1 before 2.04_1.5.4-1.23, allow remote attackers…
–
CVSS
7.5%
EPSS
No
On KEV
Description
The Internet Key Exchange version 1 (IKEv1) implementation in Openswan 2 (openswan-2) before 2.4.4, and freeswan in SUSE LINUX 9.1 before 2.04_1.5.4-1.23, allow remote attackers to cause a denial of service via (1) a crafted packet using 3DES with an invalid key length, or (2) unspecified inputs when Aggressive Mode is enabled and the PSK is known, as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1.
Exploitation
Is it being used?
Exploit prediction (EPSS)7.5% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FW
Frees Wan · Frees Wan
2.04 · source: NVD
OP
Openswan · Openswan
2.1.1; 2.1.2; 2.1.4; 2.1.5; 2.1.6; 2.2; +1 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2005-3671
CVE.org
https://www.cve.org/CVERecord?id=CVE-2005-3671
archives.neohapsis.com
http://archives.neohapsis.com/archives/bugtraq/2005-12/0138.html
archives.neohapsis.com
http://archives.neohapsis.com/archives/bugtraq/2005-12/0161.html
jvn.jp
http://jvn.jp/niscc/NISCC-273756/index.html
secunia.com
http://secunia.com/advisories/17581
secunia.com
http://secunia.com/advisories/17680
secunia.com
http://secunia.com/advisories/17980
More from Frees Wan
–
CVE-2004-0590
FreeS/WAN 1.x and 2.x, and other related products including superfreeswan 1.x, openswan 1.x before 1.0.6, openswan 2.x before 2.1.4, and strongSwan before 2.1.3, allows remote…
–
CVE-2002-0666
IPSEC implementations including (1) FreeS/WAN and (2) KAME do not properly calculate the length of authentication data, which allows remote attackers to cause a denial of service…