| Package | Affected versions | Patched versions |
|---|---|---|
| openswan | = 1.0.4= 1.0.5= 1.0.6= 1.0.7= 1.0.8= 1.0.9= 2.1.1= 2.1.2= 2.1.4= 2.1.5= 2.1.6= 2.2= 2.3 | |
| openswan | = 2.3.1= 2.4.0= 2.4.2= 2.4.4= 2.6.03= 2.6.04= 2.6.05= 2.6.06= 2.6.07= 2.6.08= 2.6.09= 2.6.10= 2.6.11= 2.6.12= 2.6.13= 2.6.14= 2.6.15= 2.6.16 |
The IPSEC livetest tool in Openswan 2.4.12 and earlier, and 2.6.x through 2.6.16, allows local users to overwrite arbitrary files and execute arbitrary code via a symlink attack on the (1) ipseclive.conn and (2) ipsec.olts.remote.log temporary files. NOTE: in many distributions and the upstream version, this tool has been disabled.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free