Problem Description
IPsec provides an anti-replay service which when enabled
prevents an attacker from successfully executing a replay
attack. This is done through the verification of sequence
numbers. A programming error in the fast_ipsec(4)
implementation results in the sequence number associated with
a Security Association not being updated, allowing packets to
unconditionally pass sequence number verification checks.
Impact
An attacker able to intercept IPSec packets can replay
them. If higher level protocols which do not provide any
protection against packet replays (e.g., UDP) are used, this
may have a variety of effects.
Workaround
No workaround is available.