PT-2010-2175 · Thegreenbow · Thegreenbow Ipsec Vpn Client

Brett Gervasoni · Published 2010-01-26 · Updated 2024-02-14 · CVE-2010-0392

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions TheGreenBow IPSec VPN Client versions 4.51.001 through 4.65.003

Description A stack-based buffer overflow issue exists, allowing user-assisted remote attackers to execute arbitrary code via a long OpenScriptAfterUp parameter in a policy (.tgb) file. This issue is related to the "phase 2" aspect of the software.

Recommendations For versions 4.51.001 through 4.65.003, avoid using long OpenScriptAfterUp parameters in policy (.tgb) files to minimize the risk of exploitation. As a temporary workaround, consider restricting the use of the OpenScriptAfterUp parameter in the affected policy files until a patch is available.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2010-0392

Affected Products

Thegreenbow Ipsec Vpn Client

References · 8

• http://senseofsecurity.com.au/advisories/SOS-10-001 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2010-0392 · Security Note
• http://thegreenbow.com/download.php?id=1000150 · Patch
• http://secunia.com/advisories/38262 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/55793 · Note
• http://securityfocus.com/bid/40387 · Note
• http://osvdb.org/61866 · Note
• http://securityfocus.com/archive/1/509091/100/0/threaded · Note