PT-2008-1102 · Openswan+1 · Openswan+1
Nofame
·
Published
2008-09-24
·
Updated
2019-07-29
·
CVE-2008-4190
CVSS v2.0
4.4
Medium
| Vector | AV:L/AC:M/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Openswan versions 2.4.12 and earlier
Openswan versions 2.6.x through 2.6.16
Description
The issue allows local users to overwrite arbitrary files and execute arbitrary code via a symlink attack on temporary files, potentially leading to disruption of confidentiality, integrity, and availability of protected information. The exploitation can be carried out locally.
Recommendations
For Openswan versions 2.4.12 and earlier, consider disabling the IPSEC livetest tool until a patch is available.
For Openswan versions 2.6.x through 2.6.16, consider disabling the IPSEC livetest tool until a patch is available.
As a temporary workaround, consider restricting access to the temporary files
ipseclive.conn and ipsec.olts.remote.log to minimize the risk of exploitation.Exploit
Fix
Link Following
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Openswan
Red Hat