Hacker News Reader

FYI, this seems to affect some configurations but not all configurations. I've had one member of the NYC BSD group ran these against his IPSec configuration with just errors, but then set up a IPSec using the OP's configuration and was able to reproduce the coredumps.

View on HN

Thank you very much for testing this exploit. The vulnerability is in gssapi.c which is only compiled in if HAVE_GSSAPI is defined. This is an optional configuration parameter, so it sounds like the configuration you tested did not have GSSAPI/kerberos enabled. That's good news for users who have a similar setup, it will give them ample time to switch to a different IPsec implementation.

Reply on news.ycombinator.com