CVE

Id
34307  
CVE No.
CVE-2008-4190  
Status
Candidate  
Description
The IPSEC livetest tool in Openswan 2.4.12 and earlier, and 2.6.x through 2.6.16, allows local users to overwrite arbitrary files and execute arbitrary code via a symlink attack on the (1) ipseclive.conn and (2) ipsec.olts.remote.log temporary files. NOTE: in many distributions and the upstream version, this tool has been disabled.  
Phase
Assigned (20080923)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
375614 34307 CVE-2008-4190 BUGTRAQ:20090309 Re: [ GLSA 200903-18 ] Openswan: Insecure temporary file creation  View
375615 34307 CVE-2008-4190 URL:http://www.securityfocus.com/archive/1/archive/1/501624/100/0/threaded  View
375616 34307 CVE-2008-4190 BUGTRAQ:20090310 Re: [ GLSA 200903-18 ] Openswan: Insecure temporary file creation  View
375617 34307 CVE-2008-4190 URL:http://www.securityfocus.com/archive/1/archive/1/501640/100/0/threaded  View
375618 34307 CVE-2008-4190 MILW0RM:9135  View
375619 34307 CVE-2008-4190 URL:http://www.milw0rm.com/exploits/9135  View
375620 34307 CVE-2008-4190 MLIST:[oss-security] 20081030 CVE requests: tempfile issues for aview, mgetty, openoffice, crossfire  View
375621 34307 CVE-2008-4190 URL:http://www.openwall.com/lists/oss-security/2008/10/30/2  View
375622 34307 CVE-2008-4190 CONFIRM:http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=496374  View
375623 34307 CVE-2008-4190 CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=460425  View
375624 34307 CVE-2008-4190 CONFIRM:http://dev.gentoo.org/~rbu/security/debiantemp/openswan  View
375625 34307 CVE-2008-4190 CONFIRM:https://bugs.gentoo.org/show_bug.cgi?id=235770  View
375626 34307 CVE-2008-4190 DEBIAN:DSA-1760  View
375627 34307 CVE-2008-4190 URL:http://www.debian.org/security/2009/dsa-1760  View
375628 34307 CVE-2008-4190 REDHAT:RHSA-2009:0402  View
375629 34307 CVE-2008-4190 URL:http://www.redhat.com/support/errata/RHSA-2009-0402.html  View
375630 34307 CVE-2008-4190 BID:31243  View
375631 34307 CVE-2008-4190 URL:http://www.securityfocus.com/bid/31243  View
375632 34307 CVE-2008-4190 OVAL:oval:org.mitre.oval:def:10078  View
375633 34307 CVE-2008-4190 URL:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10078  View
375634 34307 CVE-2008-4190 SECUNIA:34182  View
375635 34307 CVE-2008-4190 URL:http://secunia.com/advisories/34182  View
375636 34307 CVE-2008-4190 SECUNIA:34472  View
375637 34307 CVE-2008-4190 URL:http://secunia.com/advisories/34472  View
375638 34307 CVE-2008-4190 XF:openswan-livetest-symlink(45250)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
49571 JVNDB-2008-004881 pdnsd の src_dns_query におけるサービス運用妨害 (DoS) の脆弱性 pdnsd の src_dns_query の p_exec_query 関数は、解放済みのメモリ領域を指すポインタ (dangling pointer) の不具合に関連して、サービス運用妨害 (デーモンクラッシュ) 状態となる脆弱性が存在します。 CVE-2008-4194 34307 5 http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-004881.html  View