PT-2014-3332 · Red Hat · Libreswan

Publicado 2014-01-09 · Atualizado 2014-01-10 · CVE-2013-7283

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions libreswan version 3.6

Description A race condition exists in the libreswan.spec files for Red Hat Enterprise Linux (RHEL) and Fedora packages in libreswan, which involves the /var/tmp/libreswan-nss-pwd temporary file. The impact and attack vectors of this issue are not specified.

Recommendations For libreswan version 3.6, consider restricting access to the /var/tmp/libreswan-nss-pwd temporary file as a temporary workaround until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Race Condition

Enumeração de Fraquezas

CWE-362

Identificadores relacionados

CVE-2013-7283

Produtos afetados

Libreswan

Referências · 5

• 🔥 https://github.com/libreswan/libreswan/commit/ef2d756e73a188401c36133c2e2f7ce4f3c6ae55 · Exploit
• https://lists.libreswan.org/pipermail/swan-announce/2013/000007.html · Aviso do Fabricante
• http://osvdb.org/101575 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-7283 · Nota de Segurança
• http://secunia.com/advisories/56276 · Aviso do Fabricante