PT-2010-2175 · Thegreenbow · Thegreenbow Ipsec Vpn Client

Brett Gervasoni · Publicado 2010-01-26 · Atualizado 2024-02-14 · CVE-2010-0392

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions TheGreenBow IPSec VPN Client versions 4.51.001 through 4.65.003

Description A stack-based buffer overflow issue exists, allowing user-assisted remote attackers to execute arbitrary code via a long OpenScriptAfterUp parameter in a policy (.tgb) file. This issue is related to the "phase 2" aspect of the software.

Recommendations For versions 4.51.001 through 4.65.003, avoid using long OpenScriptAfterUp parameters in policy (.tgb) files to minimize the risk of exploitation. As a temporary workaround, consider restricting the use of the OpenScriptAfterUp parameter in the affected policy files until a patch is available.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2010-0392

Produtos afetados

Thegreenbow Ipsec Vpn Client

Referências · 8

• http://senseofsecurity.com.au/advisories/SOS-10-001 · Correção
• https://exchange.xforce.ibmcloud.com/vulnerabilities/55793 · Nota
• http://securityfocus.com/bid/40387 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-0392 · Nota de Segurança
• http://thegreenbow.com/download.php?id=1000150 · Correção
• http://secunia.com/advisories/38262 · Aviso do Fabricante
• http://osvdb.org/61866 · Nota
• http://securityfocus.com/archive/1/509091/100/0/threaded · Nota