VULHUB ™

It has been reported that some default IKE implementations may carry out insufficient certificate authenticity verification. The vulnerability lies in the fact that some implementations fail to thoroughly verify the authenticity of client/server certificates. Allegedly, affected implementations will verify only the Certificate Authority, not the specific certificate owner. As a result, by impersonating a server or client and sending another host a specially formatted certificate with a trusted CA, an attacker may be capable of using this attack to carry out man-in-the-middle attacks against a session carried out between a legitimate client and server. Although specific vendor product versions affected by this issue are not currently known, the researcher has stated that the following vendors are or may be affected: Microsoft Windows, Cisco, Nortel, FreeS\WAN and Certicom. It should be noted that other vendors/products may be affected as well.

It has been reported that some default IKE implementations may carry out insufficient certificate authenticity verification. The vulnerability lies in the fact that some implementations fail to thoroughly verify the authenticity of client/server certificates. Allegedly, affected implementations will verify only the Certificate Authority, not the specific certificate owner. As a result, by impersonating a server or client and sending another host a specially formatted certificate with a trusted CA, an attacker may be capable of using this attack to carry out man-in-the-middle attacks against a session carried out between a legitimate client and server. Although specific vendor product versions affected by this issue are not currently known, the researcher has stated that the following vendors are or may be affected: Microsoft Windows, Cisco, Nortel, FreeS\WAN and Certicom. It should be noted that other vendors/products may be affected as well.