PT-2014-3332 · Red Hat · Libreswan

Published 2014-01-09 · Updated 2014-01-10 · CVE-2013-7283

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions libreswan version 3.6

Description A race condition exists in the libreswan.spec files for Red Hat Enterprise Linux (RHEL) and Fedora packages in libreswan, which involves the /var/tmp/libreswan-nss-pwd temporary file. The impact and attack vectors of this issue are not specified.

Recommendations For libreswan version 3.6, consider restricting access to the /var/tmp/libreswan-nss-pwd temporary file as a temporary workaround until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2013-7283

Affected Products

Libreswan

References · 5

• 🔥 https://github.com/libreswan/libreswan/commit/ef2d756e73a188401c36133c2e2f7ce4f3c6ae55 · Exploit
• https://lists.libreswan.org/pipermail/swan-announce/2013/000007.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-7283 · Security Note
• http://secunia.com/advisories/56276 · Vendor Advisory
• http://osvdb.org/101575 · Note