Detections
Analytics
Debian DSA-1760-1 : openswan - denial of service
medium Nessus Plugin ID 36053
Synopsis
The remote Debian host is missing a security-related update.Description
Two vulnerabilities have been discovered in openswan, an IPSec implementation for linux. The Common Vulnerabilities and Exposures project identifies the following problems :- CVE-2008-4190 Dmitry E. Oboukhov discovered that the livetest tool is using temporary files insecurely, which could lead to a denial of service attack.
- CVE-2009-0790 Gerd v. Egidy discovered that the Pluto IKE daemon in openswan is prone to a denial of service attack via a malicious packet.
Solution
Upgrade the openswan packages.For the oldstable distribution (etch), this problem has been fixed in version 2.4.6+dfsg.2-1.1+etch1.
For the stable distribution (lenny), this problem has been fixed in version 2.4.12+dfsg-1.3+lenny1.
See Also
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=496374
https://security-tracker.debian.org/tracker/CVE-2008-4190
Plugin Details
Severity: Medium
ID: 36053
File Name: debian_DSA-1760.nasl
Version: 1.17
Type: local
Agent: unix
Family: Debian Local Security Checks
Published: 3/31/2009
Updated: 1/4/2021
Supported Sensors: Agentless Assessment, Frictionless Assessment Agent, Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 3.9
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P
Vulnerability Information
CPE: p-cpe:/a:debian:debian_linux:openswan, cpe:/o:debian:debian_linux:4.0, cpe:/o:debian:debian_linux:5.0
Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 3/30/2009
Reference Information
CVE: CVE-2008-4190, CVE-2009-0790