CVE-2004-0155

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

The KAME IKE Daemon Racoon, when authenticating a peer during Phase 1, validates the X.509 certificate but does not verify the RSA signature authentication, which allows remote attackers to establish unauthorized IP connections or conduct man-in-the-middle attacks using a valid, trusted X.509 certificate.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

No affected versions have been published.

Timeline

Published: Jun 1, 2004
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2004

CVE-2004-01565.0Format string vulnerabilities in the (1) die or (2) log_event functions for ssmtp before 2.50.6 allow remote mail relays to cause a denial o CVE-2004-01574.6x11.c in xonix 1.4 and earlier uses the current working directory to find and execute the rmail program, which allows local users to execute CVE-2004-01584.6Buffer overflow in lbreakout2 allows local users to gain 'games' group privileges via a large HOME environment variable to (1) editor.c, (2)CVE-2004-01597.5Format string vulnerability in hsftp 1.11 allows remote authenticated users to cause a denial of service and possibly execute arbitrary code CVE-2004-01607.2Synaesthesia 2.2 and earlier allows local users to execute arbitrary code via a symlink attack on the configuration file.CVE-2004-01617.5Multiple content security gateway and antivirus products allow remote attackers to bypass content restrictions via MIME messages that use RF CVE-2004-01627.5Multiple content security gateway and antivirus products allow remote attackers to bypass content restrictions via MIME encapsulation that u CVE-2004-01635.0Sygate Secure Enterprise (SSE) 3.5MR3 and earlier does not change the key used to encrypt data, which allows remote attackers to cause a den CVE-2004-01645.0KAME IKE daemon (racoon) does not properly handle hash values, which allows remote attackers to delete certificates via (1) a certain delete CVE-2004-01655.0Format string vulnerability in Point-to-Point Protocol (PPP) daemon (pppd) 2.4.0 for Mac OS X 10.3.2 and earlier allows remote attackers to CVE-2004-01665.0Unknown vulnerability in Safari web browser for Mac OS X 10.2.8 related to "the display of URLs in the status bar."CVE-2004-01677.5DiskArbitration in Mac OS X 10.2.8 and 10.3.2 does not properly initialize writeable removable media.