The IPSEC livetest tool in Openswan 2.4.12 and earlier, and 2.6.x through 2.6.16, allows local users to overwrite arbitrary files and execute arbitrary code via a symlink attack on the (1) ipseclive.conn and (2) ipsec.olts.remote.log temporary files. NOTE: in many distributions and the upstream version, this tool has been disabled.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2009-0402 advisory.

    [2.6.14-1.2]
    - security update (CVE-2009-0790, CVE-2008-4190)     Resolves: CVE-2009-0790, CVE-2008-4190

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Gerd v. Egidy discovered a flaw in the Dead Peer Detection (DPD) in Openswan's pluto IKE daemon. A remote attacker could use a malicious DPD packet to crash the pluto daemon. (CVE-2009-0790)

It was discovered that Openswan's livetest script created temporary files in an insecure manner. A local attacker could use this flaw to overwritearbitrary files owned by the user running the script.
(CVE-2008-4190)

After installing this update, the ipsec service will be restarted automatically.

Updated openswan packages that fix various security issues are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Openswan is a free implementation of Internet Protocol Security (IPsec) and Internet Key Exchange (IKE). IPsec uses strong cryptography to provide both authentication and encryption services.
These services allow you to build secure tunnels through untrusted networks. Everything passing through the untrusted network is encrypted by the IPsec gateway machine, and decrypted by the gateway at the other end of the tunnel. The resulting tunnel is a virtual private network (VPN).

Gerd v. Egidy discovered a flaw in the Dead Peer Detection (DPD) in Openswan's pluto IKE daemon. A remote attacker could use a malicious DPD packet to crash the pluto daemon. (CVE-2009-0790)

It was discovered that Openswan's livetest script created temporary files in an insecure manner. A local attacker could use this flaw to overwrite arbitrary files owned by the user running the script.
(CVE-2008-4190)

Note: The livetest script is an incomplete feature and was not automatically executed by any other script distributed with Openswan, or intended to be used at all, as was documented in its man page. In these updated packages, the script only prints an informative message and exits immediately when run.

All users of openswan are advised to upgrade to these updated packages, which contain backported patches to correct these issues.
After installing this update, the ipsec service will be restarted automatically.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2009:0402 advisory.

    Openswan is a free implementation of Internet Protocol Security (IPsec)     and Internet Key Exchange (IKE). IPsec uses strong cryptography to provide     both authentication and encryption services. These services allow you to     build secure tunnels through untrusted networks. Everything passing through     the untrusted network is encrypted by the IPsec gateway machine, and     decrypted by the gateway at the other end of the tunnel. The resulting     tunnel is a virtual private network (VPN).

    Gerd v. Egidy discovered a flaw in the Dead Peer Detection (DPD) in     Openswan's pluto IKE daemon. A remote attacker could use a malicious DPD     packet to crash the pluto daemon. (CVE-2009-0790)

    It was discovered that Openswan's livetest script created temporary files     in an insecure manner. A local attacker could use this flaw to overwrite     arbitrary files owned by the user running the script. (CVE-2008-4190)

    Note: The livetest script is an incomplete feature and was not     automatically executed by any other script distributed with Openswan, or     intended to be used at all, as was documented in its man page. In these     updated packages, the script only prints an informative message and exits     immediately when run.

    All users of openswan are advised to upgrade to these updated packages,     which contain backported patches to correct these issues. After installing     this update, the ipsec service will be restarted automatically.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Two vulnerabilities have been discovered in openswan, an IPSec implementation for linux. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2008-4190     Dmitry E. Oboukhov discovered that the livetest tool is     using temporary files insecurely, which could lead to a     denial of service attack.

  - CVE-2009-0790     Gerd v. Egidy discovered that the Pluto IKE daemon in     openswan is prone to a denial of service attack via a     malicious packet.

The remote host is affected by the vulnerability described in GLSA-200903-18 (Openswan: Insecure temporary file creation)

    Dmitry E. Oboukhov reported that the IPSEC livetest tool does not     handle the ipseclive.conn and ipsec.olts.remote.log temporary files     securely.
  Impact :

    A local attacker could perform symlink attacks to execute arbitrary     code and overwrite arbitrary files with the privileges of the user     running the application.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
67835	Oracle Linux 5 : openswan (ELSA-2009-0402)	Nessus	Oracle Linux Local Security Checks	high
60558	Scientific Linux Security Update : openswan on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
43738	CentOS 5 : openswan (CESA-2009:0402)	Nessus	CentOS Local Security Checks	medium
36065	RHEL 5 : openswan (RHSA-2009:0402)	Nessus	Red Hat Local Security Checks	high
36053	Debian DSA-1760-1 : openswan - denial of service	Nessus	Debian Local Security Checks	medium
35816	GLSA-200903-18 : Openswan: Insecure temporary file creation	Nessus	Gentoo Local Security Checks	medium

Detections

Analytics

CVE-2008-4190

critical

Tenable Plugins

high

medium

medium

high

medium

medium