CVE-2008-4190: Medium severity xelerance openswan vulnerability
The IPSEC livetest tool in Openswan 2.4.12 and earlier, and 2.6.x through 2.6.16, allows local users to overwrite arbitrary files and execute arbitrary code via a symlink attack on the (1) ipseclive.conn and (2) ipsec.olts.remote.log temporary files. NOTE: in many distributions and the upstream version, this tool has been disabled.
Other sources
The Openswan's IPSEC livetest tool is prone to symlink attacks.
Affected file: /usr/libexec/ipsec/livetest
Relevant part of the code:
39 wget -o /dev/null -O /tmp/ipseclive.conn "http://192.168.0.1/olts/?leftid=$leftid&$leftrsasigkey&version=$version" 40 41 sh < /tmp/ipseclive.conn 42 ipsec eroute.pl 43 leftid=echo $leftid | sed "s/@//" 44 ipsec whack --delete --name olts-$leftid >> /tmp/ipsec.olts.local.log 45 wget -o /dev/null -O /tmp/ipsec.olts.remote.log "http://192.168.0.1/olts/log.php?leftid=$leftid"
A malicious user could precreate symlink to each of the files (tmp/ipseclive.conn, /tmp/ipsec.olts.remote.log), which could allow him to destroy the target of the symlink via running the " # ipsec livetest" command by the superuser of the host.
References:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=496374
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2008-4190?
CVE-2008-4190 is considered to have a moderate severity due to its potential for arbitrary file overwrite and code execution by local users.
How do I fix CVE-2008-4190?
To mitigate CVE-2008-4190, upgrade to Openswan version 2.4.13 or later, or apply available patches.
Which versions are affected by CVE-2008-4190?
CVE-2008-4190 affects Openswan versions 2.4.12 and earlier, as well as versions 2.6.0 to 2.6.16.
Is CVE-2008-4190 exploitable remotely?
CVE-2008-4190 is not exploitable remotely as it requires local user access to perform the symlink attack.
What type of vulnerability is CVE-2008-4190?
CVE-2008-4190 is a symlink attack vulnerability that allows local users to manipulate file handling and execute arbitrary code.