PT-2002-2348 · Ietf · Ike

Publicado 2002-12-31 · Atualizado 2017-07-11 · CVE-2002-1623

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Internet Key Exchange (IKE) protocol (affected versions not specified)

Description The issue concerns the design of the Internet Key Exchange (IKE) protocol when using Aggressive Mode for shared secret authentication. This design flaw does not encrypt initiator or responder identities during negotiation. As a result, remote attackers may be able to determine valid usernames by either monitoring responses before the password is supplied or through sniffing.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2002-1623

Produtos afetados

Ike

Referências · 11

• 🔥 http://securityfocus.com/archive/1/290202 · Exploit
• 🔥 http://securiteam.com/securitynews/5TP040U8AW.html · Exploit
• http://checkpoint.com/techsupport/alerts/ike.html · Nota
• http://marc.info/?l=bugtraq&m=103124812629621&w=2 · Nota
• http://marc.info/?l=bugtraq&m=103176164729351&w=2 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/10034 · Nota
• http://kb.cert.org/vuls/id/886601 · Nota
• http://nta-monitor.com/news/checkpoint.htm · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2002-1623 · Nota de Segurança
• http://lists.grok.org.uk/pipermail/full-disclosure/2002-September/001223.html · Nota
• http://securityfocus.com/bid/5607 · Nota