PT-2010-4157 · Strongswan · Strongswan

Martin Willi · Publicado 2010-08-20 · Atualizado 2010-08-24 · CVE-2010-2628

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions strongSwan versions 4.3.x through 4.3.6 strongSwan versions 4.4.x through 4.4.0

Description The issue is related to the IKE daemon in strongSwan, where it does not properly check the return values of snprintf calls. This allows remote attackers to execute arbitrary code via crafted certificate or identity data that triggers buffer overflows.

Recommendations For strongSwan versions 4.3.x through 4.3.6, update to version 4.3.7 or later. For strongSwan versions 4.4.x through 4.4.0, update to version 4.4.1 or later.

Correção

RCE

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2010-2628

Produtos afetados

Strongswan

Referências · 18

• https://security-tracker.debian.org/tracker/CVE-2010-2628 · Aviso do Fabricante
• http://vupen.com/english/advisories/2010/2086 · Nota
• https://bugzilla.novell.com/615915 · Nota
• http://download.strongswan.org/patches/08_snprintf_patch/strongswan-4.3.5_snprintf.patch · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2010-2628 · Nota de Segurança
• https://lists.strongswan.org/pipermail/users/2010-August/005167.html · Aviso do Fabricante
• http://secunia.com/advisories/40956 · Aviso do Fabricante
• http://download.strongswan.org/patches/08_snprintf_patch/strongswan-4.3.4_snprintf.patch · Correção
• http://vupen.com/english/advisories/2010/2085 · Aviso do Fabricante
• http://securitytracker.com/id?1024338 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2010-2628 · Aviso do Fabricante
• http://securityfocus.com/bid/42444 · Correção
• http://trac.strongswan.org/projects/strongswan/wiki/441 · Nota
• http://lists.opensuse.org/opensuse-updates/2010-08/msg00026.html · Nota
• http://download.strongswan.org/patches/08_snprintf_patch/strongswan-4.3.6_snprintf.patch · Correção