CVE-2010-2628: Code Injection
Published Aug 20, 2010
·Updated
The IKE daemon in strongSwan 4.3.x before 4.3.7 and 4.4.x before 4.4.1 does not properly check the return values of snprintf calls, which allows remote attackers to execute arbitrary code via crafted (1) certificate or (2) identity data that triggers buffer overflows.
Affected Software
8 affected components
strongSwan Strongswan=4.4.0
strongSwan Strongswan=4.3.5
strongSwan Strongswan=4.3.2
strongSwan Strongswan=4.3.3
strongSwan Strongswan=4.3.0
strongSwan Strongswan=4.3.6
strongSwan Strongswan=4.3.1
strongSwan Strongswan=4.3.4
Remediation
Patch Available
Patch Available
Event History
Aug 20, 2010
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2010-2628?
CVE-2010-2628 is classified as having a high severity due to its potential for remote code execution.
2
How do I fix CVE-2010-2628?
You can fix CVE-2010-2628 by updating strongSwan to versions 4.3.7 or later, or 4.4.1 or later.
3
What versions of strongSwan are affected by CVE-2010-2628?
CVE-2010-2628 affects strongSwan versions 4.3.0 to 4.3.6 and 4.4.0.
4
What type of vulnerability is CVE-2010-2628?
CVE-2010-2628 is a buffer overflow vulnerability that can lead to arbitrary code execution.
5
Can CVE-2010-2628 be exploited remotely?
Yes, CVE-2010-2628 can be exploited remotely through crafted certificate or identity data.