1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
|
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
MITRE mistakenly issues CVE-2016-5361 for libreswan
Libreswan performs some additional hardening for the IKEv1 protocol to
prevent flaws in the IKEv1 protocol from being used in amplification
attacks. Other implementations that have not implemented such hardening,
have not been issued a CVE and this CVE has not been expanded to list
those other vendors.
The Libreswan Project believes this CVE should have been issued for
multiple vendors or for the IKE protocol itself, and that MITR should
not have singled out libreswan for actually hardening against this fault.
See discussion at:
http://www.openwall.com/lists/oss-security/2016/06/13/4
http://www.openwall.com/lists/oss-security/2016/06/14/8
http://www.openwall.com/lists/oss-security/2016/07/12/7
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAEBCgAGBQJXldG6AAoJEIX/S0OzD8b5zWAP/iBTuuXuGRSYI2aTiWfgxacx
RF+zLQ/k3E/Rq2oTd19sR0tH7+D/WKv9iFpEmCIszqG/qGuRMzSRiKT+x9GmDZtz
2DNO3j0+HGA7qWx3d8CbJ75RTu6/Mkvp3ZcmWqSMDK2JSo9CxN9sAn0Lm+Yvo0G9
ZRAWFmmY6LgAOSs17I4CE7XYLus1EMyiuudqG3ARUn/ep5+xOrAyj91nP5Wg4OCn
N01BwLMVz+2yE7T4xNpvWVBzl1dlDo7ezmtyJtO2U9m3ikabPI6VJhZ85GRChdzF
sBGZXTk7gwZOOyji9Wzfwk/6ynURSkm5gmKsUYdXqEyZkKsTl4/HxGlxptFhzVEn
QQ8uf3wwdFXZE+WWpQcB7iAzCzKBsIpQ5mHoaHS/9xJdueKNrs/iQyUlr3H//NBz
th3T68z195PZbSa19QsGnFryQsHFB8YUqpGWJepUl8c/grPQc/H8osUt02zJa3DK
OGJbPRjvbKZaRauLDMxj1/ixvOLwN5E7LYvE+l421nZARkqzWTX/CtnCnXqYVFLt
uWUZgVQuSaz++vZtlT4kOzYm0UBwaqchTBw9s/1Alb2fj7jnlbAORj00g1/kZicT
yyJ6mTG75UQMHY5RpHO85IK3f26zU7buNU6WIxfFK0Lj0n1E4EXUabTVrzXmESur
EhAjJzA2pckjaIrZYydm
=Tyl3
-----END PGP SIGNATURE-----
|
