CVE-2008-4190

Related Files

Mandriva Linux Security Advisory 2013-231

Posted Sep 12, 2013

Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2013-231 - Multiple vulnerabilities has been discovered and corrected in openswan. The IPSEC livetest tool in Openswan 2.4.12 and earlier, and 2.6.x through 2.6.16, allows local users to overwrite arbitrary files and execute arbitrary code via a symlink attack on the in many distributions and the upstream version, this tool has been disabled. The pluto IKE daemon in Openswan and Strongswan IPsec 2.6 before 2.6.21 and 2.4 before 2.4.14, and Strongswan 4.2 before 4.2.14 and 2.8 before 2.8.9, allows remote attackers to cause a denial of service (daemon crash and restart) via a crafted R_U_THERE_ACK Dead Peer Detection IPsec IKE Notification message that triggers a NULL pointer dereference related to inconsistent ISAKMP state and the lack of a phase2 state association in DPD. Various other issues have also been addressed.

tags | advisory, remote, denial of service, arbitrary, local, vulnerability

systems | linux, mandriva

advisories | CVE-2008-4190, CVE-2009-0790, CVE-2009-2185, CVE-2011-4073, CVE-2013-2053

SHA-256 | fb07f53fcbc6401898ba4775ff34c35ba6bd0724b1aaf7b8955e48769191fdc6

Download | Favorite | View

Openswan Insecure File Creation

Posted Jul 14, 2009

Authored by nofame

Openswan versions equal to and below 2.4.12/2.6.16 suffer from an insecure file creation vulnerability that allows for privilege escalation.

tags | exploit

advisories | CVE-2008-4190

SHA-256 | 5c68691ded379ac82a9787b770e69808ae5d01a5716f144e45460d3221a87b01

Download | Favorite | View

Debian Linux Security Advisory 1760-1

Posted Apr 1, 2009

Authored by Debian | Site debian.org

Debian Security Advisory 1760-1 - Two vulnerabilities have been discovered in openswan, an IPSec implementation for linux.

tags | advisory, vulnerability

systems | linux, debian

advisories | CVE-2008-4190, CVE-2009-0790

SHA-256 | 2c2aa3345edfeb4b31239b8671abeebadc6d458161424f2e9b565f1d82a519da

Download | Favorite | View

Gentoo Linux Security Advisory 200903-18

Posted Mar 9, 2009

Authored by Gentoo | Site security.gentoo.org

Gentoo Linux Security Advisory GLSA 200903-18 - An insecure temporary file usage has been reported in Openswan, allowing for symlink attacks. Dmitry E. Oboukhov reported that the IPSEC livetest tool does not handle the ipseclive.conn and ipsec.olts.remote.log temporary files securely. Versions less than 2.4.13-r2 are affected.

tags | advisory, remote

systems | linux, gentoo

advisories | CVE-2008-4190

SHA-256 | fa432b659b8ee8bf4248d6dd8c9d6c56c0794d09817d68b97ecc82cbb40f7891

Download | Favorite | View