Nortel is offering a fix for a vulnerability that could let an attacker crash a VPN router with a single malformed packet.

The denial-of-service vulnerability, reported by U.K. Internet security testing company NTA Monitor, affects several models in the Nortel VPN Router line, formerly known as the Nortel Contivity line. NTA characterized the vulnerability as serious, and Nortel gave it "major priority" status.

An attacker could cause the routers to reboot or to crash by sending a single Internet Key Exchange (IKE) packet with a malformed Internet Security Association and Key Management Protocol (ISAKMP) header, according to an advisory on NTA Monitor's Web site. In testing, most routers restarted - which takes about five minutes - and some required manual intervention to be restarted, NTA reported. The routers don't log any information about the packet, probably because they crash before having a chance to log it, according to the advisory.

Normally, it is not possible to prevent the malformed packet from reaching the router, NTA warned. An attacker could forge the packet's source or take other steps to prevent the router from blocking the packet, according to the company. The packet looks very similar to a normal IKE packet, it reported. NTA did not provide details of the malformed packet out of concern that it could be exploited by an attacker before the majority of Nortel users have patched their routers.

The vulnerability affects all products in the VPN Router 600, 1000, 2000, 4000 and 5000 lines. Nortel recommends upgrading those systems to Version 5.05.200 of the software, which was released May 16, or to install the patched versions of the Version 4.76, 4.85, 4.90 or 5.00 software, which will be made available in June, according a Nortel security bulletin.

NTA said it found the problem on March 3 while doing a VPN test for a customer, then notified Nortel, which provided the fix.

The IDG News Service is a Network World affiliate.