Hole Found in Widely Used VPN Gear

Bug makes VPN products vulnerable to a denial of service attack.

Robert McMillan, IDG News Service

Virtual private network products from a variety of vendors, including Cisco Systems and Juniper Networks, are vulnerable to a denial of service attack, thanks to a bug that was recently discovered by researchers at Finland's University of Oulu.

The flaw affects a component of the IPSec (Internet Protocol Security) protocol used by VPN software and hardware to securely exchange data over the Internet. While there is some risk of affected VPN systems being taken over by attackers, a more likely threat is a denial of service attack, in which machines would be forced to reset repeatedly, jamming up networks and causing headaches for users.

"This issue is...very important to you if you are using an IPSec VPN," said security research center The SANS Institute in a statement posted to its Web site. "While this is not as severe as remote code execution, it can still break a business if critical network links are impacted."

The Problem

The problem concerns a component of the IPSec protocol, called ISAKMP (Internet Security Association and Key Management Protocol), which is used to send authentication data within IPSec. By sending specially crafted ISAKMP packets, an attacker could launch a variety of attacks, the UK's National Infrastructure Security Co-ordination Centre said in a statement.

This bug was first reported yesterday, and by Tuesday a number of vendors had posted statements on the UK security Web site explaining how the bug affects their products.

In addition to Cisco and Juniper, the bug has been reported in products from Check Point, Stonesoft, and Secgo Software.

Researchers say that some operating systems are also affected, including Sun Microsystems' Solaris. IBM's AIX operating system and Microsoft's products are not affected by the bug, the two companies said.