CVE-2005-0039 json
Certain configurations of IPsec, when using Encapsulating Security Payload (ESP) in tunnel mode, integrity protection at a higher layer, or…
published 2005-05-10 21 y ago modified 2026-06-16 4 mo ago also EUVD-2005-0040
- cvss
- 6.4
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 4.1%
- EPSS 4.1% chance of exploitation in 30 days, percentile 90%
- public exploits
- 0
- none known
Summary
Certain configurations of IPsec, when using Encapsulating Security Payload (ESP) in tunnel mode, integrity protection at a higher layer, or Authentication Header (AH), allow remote attackers to decrypt IPSec communications by modifying the outer packet in ways that cause plaintext data from the inner packet to be returned in ICMP messages, as demonstrated using bit-flipping attacks and (1) Destination Address Rewriting, (2) a modified header length that causes portions of the packet to be interpreted as IP Options, or (3) a modified protocol field and source address.
Exploit prediction
4.08% chance of exploitation in the next 30 days, higher than 90% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 6.4 | AV:N/AC:L/Au:N/C:P/I:P/A:N |
References
-
securityfocus.com
/archive/1/407774
vendor-advisory
- niscc.gov.uk /niscc/docs/al-20050509-00386.html?lang=en
-
marc.info
/?l=bugtraq&m=111566201610350&w=2
mailing-list
-
vupen.com
/english/advisories/2005/2806
vdb-entry
-
securityfocus.com
/bid/13562
vdb-entry
-
secunia.com
/advisories/17938
third-party-advisory
-
vupen.com
/english/advisories/2005/0507
vdb-entry
-
securitytracker.com
/id?1015320
vdb-entry
-
kb.cert.org
/vuls/id/302220
third-party-advisory, us-government-resource
Sources
- CVE List CVE-2005-0039
- NVD CVE-2005-0039
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.