REDHAT-BUG-460425: Low severity Openswan IPSEC vulnerability
The Openswan's IPSEC livetest tool is prone to symlink attacks.
Affected file: /usr/libexec/ipsec/livetest
Relevant part of the code:
39 wget -o /dev/null -O /tmp/ipseclive.conn "http://192.168.0.1/olts/?leftid=$leftid&$leftrsasigkey&version=$version" 40 41 sh < /tmp/ipseclive.conn 42 ipsec eroute.pl 43 leftid=echo $leftid | sed "s/@//" 44 ipsec whack --delete --name olts-$leftid >> /tmp/ipsec.olts.local.log 45 wget -o /dev/null -O /tmp/ipsec.olts.remote.log "http://192.168.0.1/olts/log.php?leftid=$leftid"
A malicious user could precreate symlink to each of the files (tmp/ipseclive.conn, /tmp/ipsec.olts.remote.log), which could allow him to destroy the target of the symlink via running the " # ipsec livetest" command by the superuser of the host.
References:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=496374
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-460425?
The severity of REDHAT-BUG-460425 is considered medium due to potential symlink attacks that could lead to information disclosure.
How do I fix REDHAT-BUG-460425?
To fix REDHAT-BUG-460425, ensure that the Openswan IPSEC package is updated to the latest patched version.
What type of attack is related to REDHAT-BUG-460425?
REDHAT-BUG-460425 is related to symlink attacks that can exploit vulnerabilities in the IPSEC livetest tool.
Which file is affected in REDHAT-BUG-460425?
The affected file in REDHAT-BUG-460425 is /usr/libexec/ipsec/livetest.
Is REDHAT-BUG-460425 present in all versions of Openswan IPSEC?
REDHAT-BUG-460425 may not be present in all versions, but it specifically affects versions known to include the vulnerable code in the livetest tool.