CVE-2004-0220 Integer overflow in n/a

Critical 10.0 Published 25 Mar 2004 Updated 8 Aug 2024

Remote attackers can cause denial of service in OpenBSD isakmpd via malformed ISAKMP packets triggering an integer underflow.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2004-0220?

CVE-2004-0220 is a critical vulnerability in Openbsd Openbsd, published on 25 Mar 2004. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

isakmpd in OpenBSD 3.4 and earlier allows remote attackers to cause a denial of service via an ISAKMP packet with a malformed Cert Request payload, which causes an integer underflow that is used in a malloc operation that is not properly handled, as demonstrated by the Striker ISAKMP Protocol Test Suite.

Weakness: CWE-119

Which versions are affected by CVE-2004-0220?

It affects 1 product.

Products include Openbsd Openbsd.

How do I fix CVE-2004-0220?

No fix has been published for CVE-2004-0220 yet. Limit exposure of the affected software until one is available.

Is CVE-2004-0220 being exploited?

There is no known exploitation of CVE-2004-0220 in the wild and no public exploit code.

All Openbsd Openbsd vulnerabilities

Sources

Also known as GHSA-ff3x-wrw4-fq4c.