CVE:CVE-2004-0607
CNNVD:CNNVD-200412-046
Racoon是KAME的IKE守护程序。
当协商IPSec连接时Racoon不正确验证X.509证书，远程攻击者可以利用这个漏洞伪造证书访问IPSec VPN。
racoon使用eay_check_x509cert()验证证书，其中eay_check_x509cert()函数设置了验证回调：
    static int
    cb_check_cert(ok， ctx)
            int ok;
            X509_STORE_CTX *ctx;
    {
            char buf[256];
            int log_tag;
            if (!ok) {
                    [..]
                    switch (ctx->error) {
                    case X509_V_ERR_CERT_HAS_EXPIRED:
                    case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
    #if OPENSSL_VERSION_NUMBER >= 0x00905100L
                    case X509_V_ERR_INVALID_CA:
                    case X509_V_ERR_PATH_LENGTH_EXCEEDED:
                    case X509_V_ERR_INVALID_PURPOSE:
    #endif
                            ok = 1;
                            log_tag = LLV_WARNING;
                            break;
                    default:
                            log_tag = LLV_ERROR;
                    }
                    [..]
            }
            ERR_clear_error();
            return ok;
    }
如果OpenSSL由于证书过期，不正确CA签名，自签名或证书链太长等问题产生错误，racoon会忽略这些错误并允许不正确验证使用，并授权访问建立链接。未授权用户可以伪造证书，连接IPSec VPNS。
solution:Upgrade ipsec-tools ipsec-tools to a higher version than 0.3,0.3.1,0.3.2,0.3_rc1,0.3_rc2,0.3_rc3,0.3_rc4,0.3_rc5,and avoid the version 0.3,0.3.1,0.3.2,0.3_rc1,0.3_rc2,0.3_rc3,0.3_rc4,0.3_rc5; Upgrade kame racoon to a higher version than *,2003-07-11,2004-04-05,2004-04-07b,2004-05-03,and avoid the version 2003-07-11,2004-04-05,2004-04-07b,2004-05-03; Upgrade redhat enterprise_linux to a higher version than 3.0,and avoid the version 3.0; Upgrade redhat enterprise_linux_desktop to a higher version than 3.0,and avoid the version 3.0