PT-2002-2348 · Ietf · Ike

Published 2002-12-31 · Updated 2017-07-11 · CVE-2002-1623

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Internet Key Exchange (IKE) protocol (affected versions not specified)

Description The issue concerns the design of the Internet Key Exchange (IKE) protocol when using Aggressive Mode for shared secret authentication. This design flaw does not encrypt initiator or responder identities during negotiation. As a result, remote attackers may be able to determine valid usernames by either monitoring responses before the password is supplied or through sniffing.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2002-1623

Affected Products

Ike

References · 11

• 🔥 http://securityfocus.com/archive/1/290202 · Exploit
• 🔥 http://securiteam.com/securitynews/5TP040U8AW.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2002-1623 · Security Note
• http://checkpoint.com/techsupport/alerts/ike.html · Note
• http://marc.info/?l=bugtraq&m=103124812629621&w=2 · Note
• http://marc.info/?l=bugtraq&m=103176164729351&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/10034 · Note
• http://kb.cert.org/vuls/id/886601 · Note
• http://nta-monitor.com/news/checkpoint.htm · Note
• http://lists.grok.org.uk/pipermail/full-disclosure/2002-September/001223.html · Note
• http://securityfocus.com/bid/5607 · Note