ID CVE-2008-4190
Summary The IPSEC livetest tool in Openswan 2.4.12 and earlier, and 2.6.x through 2.6.16, allows local users to overwrite arbitrary files and execute arbitrary code via a symlink attack on the (1) ipseclive.conn and (2) ipsec.olts.remote.log temporary files. NOTE: in many distributions and the upstream version, this tool has been disabled.
References
Vulnerable Configurations
  • cpe:2.3:a:openswan:openswan:1.0.4
    cpe:2.3:a:openswan:openswan:1.0.4
  • cpe:2.3:a:openswan:openswan:1.0.5
    cpe:2.3:a:openswan:openswan:1.0.5
  • cpe:2.3:a:openswan:openswan:1.0.6
    cpe:2.3:a:openswan:openswan:1.0.6
  • cpe:2.3:a:openswan:openswan:1.0.7
    cpe:2.3:a:openswan:openswan:1.0.7
  • cpe:2.3:a:openswan:openswan:1.0.8
    cpe:2.3:a:openswan:openswan:1.0.8
  • cpe:2.3:a:openswan:openswan:1.0.9
    cpe:2.3:a:openswan:openswan:1.0.9
  • cpe:2.3:a:openswan:openswan:2.1.1
    cpe:2.3:a:openswan:openswan:2.1.1
  • cpe:2.3:a:openswan:openswan:2.1.2
    cpe:2.3:a:openswan:openswan:2.1.2
  • cpe:2.3:a:openswan:openswan:2.1.4
    cpe:2.3:a:openswan:openswan:2.1.4
  • cpe:2.3:a:openswan:openswan:2.1.5
    cpe:2.3:a:openswan:openswan:2.1.5
  • cpe:2.3:a:openswan:openswan:2.1.6
    cpe:2.3:a:openswan:openswan:2.1.6
  • cpe:2.3:a:openswan:openswan:2.2
    cpe:2.3:a:openswan:openswan:2.2
  • cpe:2.3:a:openswan:openswan:2.3
    cpe:2.3:a:openswan:openswan:2.3
  • Openswan 2.3.1
    cpe:2.3:a:openswan:openswan:2.3.1
  • Openswan 2.4
    cpe:2.3:a:openswan:openswan:2.4
  • Openswan 2.4.1
    cpe:2.3:a:openswan:openswan:2.4.1
  • Openswan 2.4.2
    cpe:2.3:a:openswan:openswan:2.4.2
  • Openswan 2.4.3
    cpe:2.3:a:openswan:openswan:2.4.3
  • Openswan 2.4.4
    cpe:2.3:a:openswan:openswan:2.4.4
  • Openswan 2.4.5
    cpe:2.3:a:openswan:openswan:2.4.5
  • Openswan 2.4.6
    cpe:2.3:a:openswan:openswan:2.4.6
  • Openswan 2.4.7
    cpe:2.3:a:openswan:openswan:2.4.7
  • Openswan 2.4.8
    cpe:2.3:a:openswan:openswan:2.4.8
  • Openswan 2.4.9
    cpe:2.3:a:openswan:openswan:2.4.9
  • Openswan 2.4.10
    cpe:2.3:a:openswan:openswan:2.4.10
  • Openswan 2.4.11
    cpe:2.3:a:openswan:openswan:2.4.11
  • Openswan 2.4.12
    cpe:2.3:a:openswan:openswan:2.4.12
  • Openswan 2.6.03
    cpe:2.3:a:openswan:openswan:2.6.03
  • Openswan 2.6.04
    cpe:2.3:a:openswan:openswan:2.6.04
  • Openswan 2.6.05
    cpe:2.3:a:openswan:openswan:2.6.05
  • Openswan 2.6.06
    cpe:2.3:a:openswan:openswan:2.6.06
  • Openswan 2.6.07
    cpe:2.3:a:openswan:openswan:2.6.07
  • Openswan 2.6.08
    cpe:2.3:a:openswan:openswan:2.6.08
  • Openswan 2.6.09
    cpe:2.3:a:openswan:openswan:2.6.09
  • Openswan 2.6.10
    cpe:2.3:a:openswan:openswan:2.6.10
  • Openswan 2.6.11
    cpe:2.3:a:openswan:openswan:2.6.11
  • Openswan 2.6.12
    cpe:2.3:a:openswan:openswan:2.6.12
  • Openswan 2.6.13
    cpe:2.3:a:openswan:openswan:2.6.13
  • Openswan 2.6.14
    cpe:2.3:a:openswan:openswan:2.6.14
  • Openswan 2.6.15
    cpe:2.3:a:openswan:openswan:2.6.15
  • Openswan 2.6.16
    cpe:2.3:a:openswan:openswan:2.6.16
CVSS
Base: 4.4 (as of 24-09-2008 - 12:46)
Impact:
Exploitability:
CWE CWE-59
CAPEC
  • Symlink Attack
    An attacker positions a symbolic link in such a manner that the targeted user or application accesses the link's endpoint, assuming that it is accessing a file with the link's name. The endpoint file may be either output or input. If the file is output, the result is that the endpoint is modified, instead of a file at the intended location. Modifications to the endpoint file may include appending, overwriting, corrupting, changing permissions, or other modifications. In some variants of this attack the attacker may be able to control the change to a file while in other cases they cannot. The former is especially damaging since the attacker may be able to grant themselves increased privileges or insert false information, but the latter can also be damaging as it can expose sensitive information or corrupt or destroy vital system or application files. Alternatively, the endpoint file may serve as input to the targeted application. This can be used to feed malformed input into the target or to cause the target to process different information, possibly allowing the attacker to control the actions of the target or to cause the target to expose information to the attacker. Moreover, the actions taken on the endpoint file are undertaken with the permissions of the targeted user or application, which may exceed the permissions that the attacker would normally have.
  • Accessing, Modifying or Executing Executable Files
    An attack of this type exploits a system's configuration that allows an attacker to either directly access an executable file, for example through shell access; or in a possible worst case allows an attacker to upload a file and then execute it. Web servers, ftp servers, and message oriented middleware systems which have many integration points are particularly vulnerable, because both the programmers and the administrators must be in synch regarding the interfaces and the correct privileges for each interface.
  • Leverage Executable Code in Non-Executable Files
    An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high. The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/) http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process. The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name "public" grants all users with the public role the ability to use the administration functionality. The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
  • Manipulating Input to File System Calls
    An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible.
Access
VectorComplexityAuthentication
LOCAL MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
exploit-db via4
description Openswan <= 2.4.12/2.6.16 Insecure Temp File Creation Root Exploit. CVE-2008-4190. Local exploit for linux platform
file exploits/linux/local/9135.sh
id EDB-ID:9135
last seen 2016-02-01
modified 2009-07-13
platform linux
port
published 2009-07-13
reporter nofame
source https://www.exploit-db.com/download/9135/
title Openswan <= 2.4.12/2.6.16 Insecure Temp File Creation Root Exploit
type local
nessus via4
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-200903-18.NASL
    description The remote host is affected by the vulnerability described in GLSA-200903-18 (Openswan: Insecure temporary file creation) Dmitry E. Oboukhov reported that the IPSEC livetest tool does not handle the ipseclive.conn and ipsec.olts.remote.log temporary files securely. Impact : A local attacker could perform symlink attacks to execute arbitrary code and overwrite arbitrary files with the privileges of the user running the application. Workaround : There is no known workaround at this time.
    last seen 2019-02-21
    modified 2018-07-11
    plugin id 35816
    published 2009-03-10
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=35816
    title GLSA-200903-18 : Openswan: Insecure temporary file creation
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2009-0402.NASL
    description Updated openswan packages that fix various security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. Openswan is a free implementation of Internet Protocol Security (IPsec) and Internet Key Exchange (IKE). IPsec uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks. Everything passing through the untrusted network is encrypted by the IPsec gateway machine, and decrypted by the gateway at the other end of the tunnel. The resulting tunnel is a virtual private network (VPN). Gerd v. Egidy discovered a flaw in the Dead Peer Detection (DPD) in Openswan's pluto IKE daemon. A remote attacker could use a malicious DPD packet to crash the pluto daemon. (CVE-2009-0790) It was discovered that Openswan's livetest script created temporary files in an insecure manner. A local attacker could use this flaw to overwrite arbitrary files owned by the user running the script. (CVE-2008-4190) Note: The livetest script is an incomplete feature and was not automatically executed by any other script distributed with Openswan, or intended to be used at all, as was documented in its man page. In these updated packages, the script only prints an informative message and exits immediately when run. All users of openswan are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, the ipsec service will be restarted automatically.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 43738
    published 2010-01-06
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=43738
    title CentOS 5 : openswan (CESA-2009:0402)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2009-0402.NASL
    description Updated openswan packages that fix various security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. Openswan is a free implementation of Internet Protocol Security (IPsec) and Internet Key Exchange (IKE). IPsec uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks. Everything passing through the untrusted network is encrypted by the IPsec gateway machine, and decrypted by the gateway at the other end of the tunnel. The resulting tunnel is a virtual private network (VPN). Gerd v. Egidy discovered a flaw in the Dead Peer Detection (DPD) in Openswan's pluto IKE daemon. A remote attacker could use a malicious DPD packet to crash the pluto daemon. (CVE-2009-0790) It was discovered that Openswan's livetest script created temporary files in an insecure manner. A local attacker could use this flaw to overwrite arbitrary files owned by the user running the script. (CVE-2008-4190) Note: The livetest script is an incomplete feature and was not automatically executed by any other script distributed with Openswan, or intended to be used at all, as was documented in its man page. In these updated packages, the script only prints an informative message and exits immediately when run. All users of openswan are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, the ipsec service will be restarted automatically.
    last seen 2019-02-21
    modified 2018-11-27
    plugin id 36065
    published 2009-03-31
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=36065
    title RHEL 5 : openswan (RHSA-2009:0402)
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2009-0402.NASL
    description From Red Hat Security Advisory 2009:0402 : Updated openswan packages that fix various security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. Openswan is a free implementation of Internet Protocol Security (IPsec) and Internet Key Exchange (IKE). IPsec uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks. Everything passing through the untrusted network is encrypted by the IPsec gateway machine, and decrypted by the gateway at the other end of the tunnel. The resulting tunnel is a virtual private network (VPN). Gerd v. Egidy discovered a flaw in the Dead Peer Detection (DPD) in Openswan's pluto IKE daemon. A remote attacker could use a malicious DPD packet to crash the pluto daemon. (CVE-2009-0790) It was discovered that Openswan's livetest script created temporary files in an insecure manner. A local attacker could use this flaw to overwrite arbitrary files owned by the user running the script. (CVE-2008-4190) Note: The livetest script is an incomplete feature and was not automatically executed by any other script distributed with Openswan, or intended to be used at all, as was documented in its man page. In these updated packages, the script only prints an informative message and exits immediately when run. All users of openswan are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, the ipsec service will be restarted automatically.
    last seen 2019-02-21
    modified 2018-07-18
    plugin id 67835
    published 2013-07-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=67835
    title Oracle Linux 5 : openswan (ELSA-2009-0402)
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20090330_OPENSWAN_ON_SL5_X.NASL
    description Gerd v. Egidy discovered a flaw in the Dead Peer Detection (DPD) in Openswan's pluto IKE daemon. A remote attacker could use a malicious DPD packet to crash the pluto daemon. (CVE-2009-0790) It was discovered that Openswan's livetest script created temporary files in an insecure manner. A local attacker could use this flaw to overwritearbitrary files owned by the user running the script. (CVE-2008-4190) After installing this update, the ipsec service will be restarted automatically.
    last seen 2019-02-21
    modified 2019-01-02
    plugin id 60558
    published 2012-08-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=60558
    title Scientific Linux Security Update : openswan on SL5.x i386/x86_64
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-1760.NASL
    description Two vulnerabilities have been discovered in openswan, an IPSec implementation for linux. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2008-4190 Dmitry E. Oboukhov discovered that the livetest tool is using temporary files insecurely, which could lead to a denial of service attack. - CVE-2009-0790 Gerd v. Egidy discovered that the Pluto IKE daemon in openswan is prone to a denial of service attack via a malicious packet.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 36053
    published 2009-03-31
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=36053
    title Debian DSA-1760-1 : openswan - denial of service
oval via4
accepted 2013-04-29T04:01:18.652-04:00
class vulnerability
contributors
  • name Aharon Chernin
    organization SCAP.com, LLC
  • name Dragos Prisaca
    organization G2, Inc.
definition_extensions
  • comment The operating system installed on the system is Red Hat Enterprise Linux 5
    oval oval:org.mitre.oval:def:11414
  • comment The operating system installed on the system is CentOS Linux 5.x
    oval oval:org.mitre.oval:def:15802
  • comment Oracle Linux 5.x
    oval oval:org.mitre.oval:def:15459
description The IPSEC livetest tool in Openswan 2.4.12 and earlier, and 2.6.x through 2.6.16, allows local users to overwrite arbitrary files and execute arbitrary code via a symlink attack on the (1) ipseclive.conn and (2) ipsec.olts.remote.log temporary files. NOTE: in many distributions and the upstream version, this tool has been disabled.
family unix
id oval:org.mitre.oval:def:10078
status accepted
submitted 2010-07-09T03:56:16-04:00
title The IPSEC livetest tool in Openswan 2.4.12 and earlier, and 2.6.x through 2.6.16, allows local users to overwrite arbitrary files and execute arbitrary code via a symlink attack on the (1) ipseclive.conn and (2) ipsec.olts.remote.log temporary files. NOTE: in many distributions and the upstream version, this tool has been disabled.
version 18
packetstorm via4
data source https://packetstormsecurity.com/files/download/79168/openswan-symlink.txt
id PACKETSTORM:79168
last seen 2016-12-05
published 2009-07-14
reporter nofame
source https://packetstormsecurity.com/files/79168/Openswan-Insecure-File-Creation.html
title Openswan Insecure File Creation
redhat via4
advisories
rhsa
id RHSA-2009:0402
rpms
  • openswan-0:2.6.14-1.el5_3.2
  • openswan-doc-0:2.6.14-1.el5_3.2
refmap via4
bid 31243
bugtraq
  • 20090309 Re: [ GLSA 200903-18 ] Openswan: Insecure temporary file creation
  • 20090310 Re: [ GLSA 200903-18 ] Openswan: Insecure temporary file creation
confirm
debian DSA-1760
exploit-db 9135
mlist [oss-security] 20081030 CVE requests: tempfile issues for aview, mgetty, openoffice, crossfire
secunia
  • 34182
  • 34472
xf openswan-livetest-symlink(45250)
statements via4
contributor Joshua Bressers
lastmodified 2009-03-30
organization Red Hat
statement This issue has been addressed via: https://rhn.redhat.com/errata/RHSA-2009-0402.html
Last major update 15-11-2010 - 00:00
Published 24-09-2008 - 07:42
Last modified 11-10-2018 - 16:51
Back to Top