CVE-2004-0164: KAME IKE daemon (racoon) does not properly handle hash values, which allows remote attackers to delete certifi

This month

MEDIUM 5.0DOWNGRADE

CVE-2004-0164 is a medium-severity flaw (CVSS 5.0) affecting racoon. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

KAME IKE daemon (racoon) does not properly handle hash values, which allows remote attackers to delete certificates via (1) a certain delete message that is not properly handled in isakmp.c or isakmp_inf.c, or (2) a certain INITIAL-CONTACT message that is not properly handled in isakmp_inf.c.

Why this priority

EPSS top 6%: very likely to be exploited
Public exploit reference

No fix is published yet: follow the downgrade or mitigation steps.

Risk facts

CVSS score	5.0 (Medium)
EPSS exploit chance	6.7% (top 6%)
CISA exploited list	No
Published	2004-03-03
Last modified	2026-06-16

Publisher (CNA): MITRE · Vendor: kame

Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2004-03-03 05:00 UTCPublished CVE record published
2026-06-16 22:05 UTCUpdated Record last modified

kame racoon DOWNGRADE

Affected: all_versions

Fixed in: no fixed release known

Safe to downgrade to: a release before all_versions

1. Check installed version

apt-cache policy racoon || rpm -q racoon || racoon --version

2. No fixed release: DOWNGRADE to a release before all_versions (Debian / Ubuntu)

apt-cache madison racoon sudo apt install racoon=<VERSION_BEFORE_all_versions> sudo apt-mark hold racoon

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list racoon sudo dnf downgrade racoon-<VERSION_BEFORE_all_versions> sudo dnf versionlock add racoon

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

Exploit-DB: KAME Racoon - 'Initial Contact' SA Deletion

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2004-0164?

racoon: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2004-0164 being exploited?

CVE-2004-0164 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2004-0164 affect?

CVE-2004-0164 affects racoon. Severity is medium (CVSS 5.0). KAME IKE daemon (racoon) does not properly handle hash values, which allows remote attackers to delete certificates via (1) a certain delete message that is not properly handled in isakmp.c or isakmp_inf.c, or (2) a certain INITIAL-CONTACT

How urgent is CVE-2004-0164?

Priority 46/100. EPSS top 6%: very likely to be exploited; Public exploit reference

Related CVEs

CVE-2005-0398 MEDIUM 5.0 DOWNGRADE DOWNGRADE The KAME racoon daemon in ipsec-tools before 0.5 allows remote attackers to cause a denial of service (crash)
CVE-2004-0607 HIGH 10.0 DOWNGRADE DOWNGRADE The eay_check_x509cert function in KAME Racoon successfully verifies certificates even when OpenSSL validation
CVE-2004-0403 MEDIUM 5.0 UPGRADE Racoon before 20040408a allows remote attackers to cause a denial of service (memory consumption) via an ISAKM
CVE-2004-0392 MEDIUM 5.0 UPGRADE racoon before 20040407b allows remote attackers to cause a denial of service (infinite loop and dropped connec
CVE-2004-0155 HIGH 7.5 MITIGATE The KAME IKE Daemon Racoon, when authenticating a peer during Phase 1, validates the X.509 certificate but doe

References

← Back to latest CVEs