Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2008-4190

The IPSEC livetest tool in Openswan 2.4.12 and earlier, and 2.6.x through 2.6.16, allows local users to overwrite arbitrary files and execute arbitrary code via a symlink attack on the (1) ipseclive.conn and (2) ipsec.olts.remote.log temporary files. NOTE: in many distributions and the upstream version, this tool has been disabled.

Published

2008-09-24T11:42:25.250

Last Modified

2025-04-09T00:30:58.490

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 4.4 (MEDIUM)

CVSSv2 Vector

AV:L/AC:M/Au:N/C:P/I:P/A:P

  • Access Vector: LOCAL
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

3.4

Impact Score

6.4

Weaknesses
  • Type: Primary
    CWE-59
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application openswan openswan 1.0.4 Yes
Application openswan openswan 1.0.5 Yes
Application openswan openswan 1.0.6 Yes
Application openswan openswan 1.0.7 Yes
Application openswan openswan 1.0.8 Yes
Application openswan openswan 1.0.9 Yes
Application openswan openswan 2.1.1 Yes
Application openswan openswan 2.1.2 Yes
Application openswan openswan 2.1.4 Yes
Application openswan openswan 2.1.5 Yes
Application openswan openswan 2.1.6 Yes
Application openswan openswan 2.2 Yes
Application openswan openswan 2.3 Yes
Application xelerance openswan 2.3.1 Yes
Application xelerance openswan 2.4.0 Yes
Application xelerance openswan 2.4.1 No
Application xelerance openswan 2.4.2 Yes
Application xelerance openswan 2.4.3 No
Application xelerance openswan 2.4.4 Yes
Application xelerance openswan 2.4.5 No
Application xelerance openswan 2.4.6 No
Application xelerance openswan 2.4.7 No
Application xelerance openswan 2.4.8 No
Application xelerance openswan 2.4.9 No
Application xelerance openswan 2.4.10 No
Application xelerance openswan 2.4.11 No
Application xelerance openswan 2.4.12 No
Application xelerance openswan 2.6.03 Yes
Application xelerance openswan 2.6.04 Yes
Application xelerance openswan 2.6.05 Yes
Application xelerance openswan 2.6.06 Yes
Application xelerance openswan 2.6.07 Yes
Application xelerance openswan 2.6.08 Yes
Application xelerance openswan 2.6.09 Yes
Application xelerance openswan 2.6.10 Yes
Application xelerance openswan 2.6.11 Yes
Application xelerance openswan 2.6.12 Yes
Application xelerance openswan 2.6.13 Yes
Application xelerance openswan 2.6.14 Yes
Application xelerance openswan 2.6.15 Yes
Application xelerance openswan 2.6.16 Yes
References