Nortel issues patch for router VPN flaw

IDG News Service - Nortel Networks Corp. is offering a fix for a vulnerability that could let an attacker crash a virtual private network (VPN) router with a single malformed packet.
The denial-of-service vulnerability, reported by U.K.-based Internet security testing company NTA Monitor Ltd., affects several models in the Nortel VPN Router line, formerly known as the Nortel Contivity line. NTA characterized the vulnerability as serious, and Nortel gave it "major priority" status.
An attacker could cause the routers to reboot or to crash by sending a single Internet Key Exchange (IKE) packet with a malformed Internet Security Association and Key Management Protocol header, according to an advisory on NTA Monitor's Web site. In testing, most routers restarted -- which takes about five minutes -- and some required manual intervention to be restarted, NTA said. The routers don't log any information about the packet, probably because they crash before having a chance to log it, according to the advisory.
Normally, it is not possible to prevent the malformed packet from reaching the router, NTA warned. An attacker could forge the packet's source or take other steps to prevent the router from blocking the packet, according to the company. The packet looks very similar to a normal IKE packet.
NTA did not provide details of the malformed packet out of concern that it could be exploited by an attacker before the majority of Nortel users have patched their routers.
The vulnerability affects all products in the VPN Router 600, 1000, 2000, 4000 and 5000 lines. Nortel recommends upgrading those systems to Version 5.05.200 of the software, which was released May 16, or to install the patched versions of the Version 4.76, 4.85, 4.90 or 5.00 software, which will be made available this month, according to a Nortel security bulletin.
NTA said it found the problem March 3 while doing a VPN test for a customer, then notified Nortel, which provided the fix.