Description
The IPSEC livetest tool in Openswan 2.4.12 and earlier, and 2.6.x through 2.6.16, allows local users to overwrite arbitrary files and execute arbitrary code via a symlink attack on the (1) ipseclive.conn and (2) ipsec.olts.remote.log temporary files. NOTE: in many distributions and the upstream version, this tool has been disabled.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://secunia.com/advisories/34472 ↗
- https://bugzilla.redhat.com/show_bug.cgi?id=460425 ↗
- http://www.openwall.com/lists/oss-security/2008/10/30/2 ↗
- https://bugs.gentoo.org/show_bug.cgi?id=235770 ↗
- http://www.securityfocus.com/archive/1/501624/100/0/threaded ↗
- http://secunia.com/advisories/34182 ↗
- http://www.securityfocus.com/archive/1/501640/100/0/threaded ↗
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10078 ↗
- http://dev.gentoo.org/~rbu/security/debiantemp/openswan ↗
- http://www.securityfocus.com/bid/31243 ↗
- https://www.exploit-db.com/exploits/9135 ↗
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=496374 ↗
- http://www.redhat.com/support/errata/RHSA-2009-0402.html ↗
- https://exchange.xforce.ibmcloud.com/vulnerabilities/45250 ↗
- http://www.debian.org/security/2009/dsa-1760 ↗