Openswan IPsec Livetest Insecure Temporary File Creation Vulnerability

Bugtraq ID:	31243
Class:	Design Error
CVE:	CVE-2008-4190
Remote:	No
Local:	Yes
Published:	Aug 24 2008 12:00AM
Updated:	Apr 13 2015 09:46PM
Credit:	Dmitry E. Oboukhov
Vulnerable:	Redhat Enterprise Linux Desktop 5 client Redhat Enterprise Linux 5 Server Openswan Openswan 2.6.16 Openswan Openswan 2.4.4 Openswan Openswan 2.4.2 Openswan Openswan 2.4 Openswan Openswan 2.3.1 Openswan Openswan 2.3 Openswan Openswan 2.2 Openswan Openswan 2.1.6 Openswan Openswan 2.1.5 + Redhat Fedora Core3 Openswan Openswan 2.1.4 Openswan Openswan 2.1.2 Openswan Openswan 2.1.1 Openswan Openswan 1.0.9 Openswan Openswan 1.0.8 Openswan Openswan 1.0.7 Openswan Openswan 1.0.6 Openswan Openswan 1.0.5 Openswan Openswan 1.0.4 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 Gentoo Linux Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0 Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 armel Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0
Not Vulnerable:	Openswan Openswan 2.6.20

Openswan IPsec Livetest Insecure Temporary File Creation Vulnerability

Openswan creates temporary files in an insecure manner.

An attacker with local access could potentially exploit these issues to perform symbolic-link attacks, overwriting arbitrary files in the context of the affected application.

Successfully mounting a symlink attack may allow the attacker to delete or corrupt sensitive files, which may result in a denial of service. Other attacks may also be possible.

UPDATE (March 9, 2009): The vendor disputes the validity of this issue, stating that the vulnerable code was incomplete and never run from within the application. The vendor also reports that the latest version of Openswan has disabled the offending code.

Openswan IPsec Livetest Insecure Temporary File Creation Vulnerability

An attacker uses readily available commands to exploit this issue.

The following exploit is available:

• /data/vulnerabilities/exploits/31243.sh

Openswan IPsec Livetest Insecure Temporary File Creation Vulnerability

Solution:
Updates are available. Please see the references for details.


Debian Linux 4.0 arm

• Debian linux-patch-openswan_2.4.6+dfsg.2-1.1+etch1_all.deb
  http://security.debian.org/pool/updates/main/o/openswan/linux-patch-op enswan_2.4.6+dfsg.2-1.1+etch1_all.deb


• Debian openswan-modules-source_2.4.6+dfsg.2-1.1+etch1_all.deb
  http://security.debian.org/pool/updates/main/o/openswan/openswan-modul es-source_2.4.6+dfsg.2-1.1+etch1_all.deb


• Debian openswan_2.4.6+dfsg.2-1.1+etch1_arm.deb
  http://security.debian.org/pool/updates/main/o/openswan/openswan_2.4.6 +dfsg.2-1.1+etch1_arm.deb

Debian Linux 5.0 ia-64

• Debian linux-patch-openswan_2.4.12+dfsg-1.3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/o/openswan/linux-patch-op enswan_2.4.12+dfsg-1.3+lenny1_all.deb


• Debian openswan-modules-source_2.4.12+dfsg-1.3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/o/openswan/openswan-modul es-source_2.4.12+dfsg-1.3+lenny1_all.deb


• Debian openswan_2.4.12+dfsg-1.3+lenny1_ia64.deb
  http://security.debian.org/pool/updates/main/o/openswan/openswan_2.4.1 2+dfsg-1.3+lenny1_ia64.deb

Debian Linux 4.0 powerpc

• Debian linux-patch-openswan_2.4.6+dfsg.2-1.1+etch1_all.deb
  http://security.debian.org/pool/updates/main/o/openswan/linux-patch-op enswan_2.4.6+dfsg.2-1.1+etch1_all.deb


• Debian openswan-modules-source_2.4.6+dfsg.2-1.1+etch1_all.deb
  http://security.debian.org/pool/updates/main/o/openswan/openswan-modul es-source_2.4.6+dfsg.2-1.1+etch1_all.deb


• Debian openswan_2.4.6+dfsg.2-1.1+etch1_powerpc.deb
  http://security.debian.org/pool/updates/main/o/openswan/openswan_2.4.6 +dfsg.2-1.1+etch1_powerpc.deb

MandrakeSoft Enterprise Server 5 x86_64

• Mandriva openswan-2.6.16-1.1mdvmes5.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva openswan-doc-2.6.16-1.1mdvmes5.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/

Debian Linux 4.0 m68k

• Debian linux-patch-openswan_2.4.6+dfsg.2-1.1+etch1_all.deb
  http://security.debian.org/pool/updates/main/o/openswan/linux-patch-op enswan_2.4.6+dfsg.2-1.1+etch1_all.deb


• Debian openswan-modules-source_2.4.6+dfsg.2-1.1+etch1_all.deb
  http://security.debian.org/pool/updates/main/o/openswan/openswan-modul es-source_2.4.6+dfsg.2-1.1+etch1_all.deb

Debian Linux 5.0 alpha

• Debian linux-patch-openswan_2.4.12+dfsg-1.3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/o/openswan/linux-patch-op enswan_2.4.12+dfsg-1.3+lenny1_all.deb


• Debian openswan-modules-source_2.4.12+dfsg-1.3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/o/openswan/openswan-modul es-source_2.4.12+dfsg-1.3+lenny1_all.deb


• Debian openswan_2.4.12+dfsg-1.3+lenny1_alpha.deb
  http://security.debian.org/pool/updates/main/o/openswan/openswan_2.4.1 2+dfsg-1.3+lenny1_alpha.deb

Debian Linux 5.0 ia-32

• Debian linux-patch-openswan_2.4.12+dfsg-1.3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/o/openswan/linux-patch-op enswan_2.4.12+dfsg-1.3+lenny1_all.deb


• Debian openswan-modules-source_2.4.12+dfsg-1.3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/o/openswan/openswan-modul es-source_2.4.12+dfsg-1.3+lenny1_all.deb


• Debian openswan_2.4.12+dfsg-1.3+lenny1_i386.deb
  http://security.debian.org/pool/updates/main/o/openswan/openswan_2.4.1 2+dfsg-1.3+lenny1_i386.deb

MandrakeSoft Enterprise Server 5

• Mandriva openswan-2.6.16-1.1mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva openswan-doc-2.6.16-1.1mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/

Debian Linux 5.0 s/390

• Debian linux-patch-openswan_2.4.12+dfsg-1.3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/o/openswan/linux-patch-op enswan_2.4.12+dfsg-1.3+lenny1_all.deb


• Debian openswan-modules-source_2.4.12+dfsg-1.3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/o/openswan/openswan-modul es-source_2.4.12+dfsg-1.3+lenny1_all.deb


• Debian openswan_2.4.12+dfsg-1.3+lenny1_s390.deb
  http://security.debian.org/pool/updates/main/o/openswan/openswan_2.4.1 2+dfsg-1.3+lenny1_s390.deb

Debian Linux 5.0 mipsel

• Debian linux-patch-openswan_2.4.12+dfsg-1.3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/o/openswan/linux-patch-op enswan_2.4.12+dfsg-1.3+lenny1_all.deb


• Debian openswan-modules-source_2.4.12+dfsg-1.3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/o/openswan/openswan-modul es-source_2.4.12+dfsg-1.3+lenny1_all.deb


• Debian openswan_2.4.12+dfsg-1.3+lenny1_mipsel.deb
  http://security.debian.org/pool/updates/main/o/openswan/openswan_2.4.1 2+dfsg-1.3+lenny1_mipsel.deb

Debian Linux 4.0 amd64

• Debian linux-patch-openswan_2.4.6+dfsg.2-1.1+etch1_all.deb
  http://security.debian.org/pool/updates/main/o/openswan/linux-patch-op enswan_2.4.6+dfsg.2-1.1+etch1_all.deb


• Debian openswan-modules-source_2.4.6+dfsg.2-1.1+etch1_all.deb
  http://security.debian.org/pool/updates/main/o/openswan/openswan-modul es-source_2.4.6+dfsg.2-1.1+etch1_all.deb


• Debian openswan_2.4.6+dfsg.2-1.1+etch1_amd64.deb
  http://security.debian.org/pool/updates/main/o/openswan/openswan_2.4.6 +dfsg.2-1.1+etch1_amd64.deb

Debian Linux 4.0 ia-32

• Debian linux-patch-openswan_2.4.6+dfsg.2-1.1+etch1_all.deb
  http://security.debian.org/pool/updates/main/o/openswan/linux-patch-op enswan_2.4.6+dfsg.2-1.1+etch1_all.deb


• Debian openswan-modules-source_2.4.6+dfsg.2-1.1+etch1_all.deb
  http://security.debian.org/pool/updates/main/o/openswan/openswan-modul es-source_2.4.6+dfsg.2-1.1+etch1_all.deb


• Debian openswan_2.4.6+dfsg.2-1.1+etch1_i386.deb
  http://security.debian.org/pool/updates/main/o/openswan/openswan_2.4.6 +dfsg.2-1.1+etch1_i386.deb

Debian Linux 5.0 hppa

• Debian linux-patch-openswan_2.4.12+dfsg-1.3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/o/openswan/linux-patch-op enswan_2.4.12+dfsg-1.3+lenny1_all.deb


• Debian openswan-modules-source_2.4.12+dfsg-1.3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/o/openswan/openswan-modul es-source_2.4.12+dfsg-1.3+lenny1_all.deb


• Debian openswan_2.4.12+dfsg-1.3+lenny1_hppa.deb
  http://security.debian.org/pool/updates/main/o/openswan/openswan_2.4.1 2+dfsg-1.3+lenny1_hppa.deb

Debian Linux 4.0 hppa

• Debian linux-patch-openswan_2.4.6+dfsg.2-1.1+etch1_all.deb
  http://security.debian.org/pool/updates/main/o/openswan/linux-patch-op enswan_2.4.6+dfsg.2-1.1+etch1_all.deb


• Debian openswan-modules-source_2.4.6+dfsg.2-1.1+etch1_all.deb
  http://security.debian.org/pool/updates/main/o/openswan/openswan-modul es-source_2.4.6+dfsg.2-1.1+etch1_all.deb


• Debian openswan_2.4.6+dfsg.2-1.1+etch1_hppa.deb
  http://security.debian.org/pool/updates/main/o/openswan/openswan_2.4.6 +dfsg.2-1.1+etch1_hppa.deb

Debian Linux 4.0 sparc

• Debian linux-patch-openswan_2.4.6+dfsg.2-1.1+etch1_all.deb
  http://security.debian.org/pool/updates/main/o/openswan/linux-patch-op enswan_2.4.6+dfsg.2-1.1+etch1_all.deb


• Debian openswan-modules-source_2.4.6+dfsg.2-1.1+etch1_all.deb
  http://security.debian.org/pool/updates/main/o/openswan/openswan-modul es-source_2.4.6+dfsg.2-1.1+etch1_all.deb


• Debian openswan_2.4.6+dfsg.2-1.1+etch1_sparc.deb
  http://security.debian.org/pool/updates/main/o/openswan/openswan_2.4.6 +dfsg.2-1.1+etch1_sparc.deb

Debian Linux 4.0 s/390

• Debian linux-patch-openswan_2.4.6+dfsg.2-1.1+etch1_all.deb
  http://security.debian.org/pool/updates/main/o/openswan/linux-patch-op enswan_2.4.6+dfsg.2-1.1+etch1_all.deb


• Debian openswan-modules-source_2.4.6+dfsg.2-1.1+etch1_all.deb
  http://security.debian.org/pool/updates/main/o/openswan/openswan-modul es-source_2.4.6+dfsg.2-1.1+etch1_all.deb


• Debian openswan_2.4.6+dfsg.2-1.1+etch1_s390.deb
  http://security.debian.org/pool/updates/main/o/openswan/openswan_2.4.6 +dfsg.2-1.1+etch1_s390.deb

Debian Linux 5.0 m68k

• Debian linux-patch-openswan_2.4.12+dfsg-1.3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/o/openswan/linux-patch-op enswan_2.4.12+dfsg-1.3+lenny1_all.deb


• Debian openswan-modules-source_2.4.12+dfsg-1.3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/o/openswan/openswan-modul es-source_2.4.12+dfsg-1.3+lenny1_all.deb

Debian Linux 5.0 arm

• Debian linux-patch-openswan_2.4.12+dfsg-1.3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/o/openswan/linux-patch-op enswan_2.4.12+dfsg-1.3+lenny1_all.deb


• Debian openswan-modules-source_2.4.12+dfsg-1.3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/o/openswan/openswan-modul es-source_2.4.12+dfsg-1.3+lenny1_all.deb


• Debian openswan_2.4.12+dfsg-1.3+lenny1_arm.deb
  http://security.debian.org/pool/updates/main/o/openswan/openswan_2.4.1 2+dfsg-1.3+lenny1_arm.deb

Debian Linux 4.0 alpha

• Debian linux-patch-openswan_2.4.6+dfsg.2-1.1+etch1_all.deb
  http://security.debian.org/pool/updates/main/o/openswan/linux-patch-op enswan_2.4.6+dfsg.2-1.1+etch1_all.deb


• Debian openswan-modules-source_2.4.6+dfsg.2-1.1+etch1_all.deb
  http://security.debian.org/pool/updates/main/o/openswan/openswan-modul es-source_2.4.6+dfsg.2-1.1+etch1_all.deb


• Debian openswan_2.4.6+dfsg.2-1.1+etch1_alpha.deb
  http://security.debian.org/pool/updates/main/o/openswan/openswan_2.4.6 +dfsg.2-1.1+etch1_alpha.deb

Debian Linux 4.0 armel

• Debian linux-patch-openswan_2.4.6+dfsg.2-1.1+etch1_all.deb
  http://security.debian.org/pool/updates/main/o/openswan/linux-patch-op enswan_2.4.6+dfsg.2-1.1+etch1_all.deb


• Debian openswan-modules-source_2.4.6+dfsg.2-1.1+etch1_all.deb
  http://security.debian.org/pool/updates/main/o/openswan/openswan-modul es-source_2.4.6+dfsg.2-1.1+etch1_all.deb

Debian Linux 5.0 armel

• Debian linux-patch-openswan_2.4.12+dfsg-1.3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/o/openswan/linux-patch-op enswan_2.4.12+dfsg-1.3+lenny1_all.deb


• Debian openswan-modules-source_2.4.12+dfsg-1.3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/o/openswan/openswan-modul es-source_2.4.12+dfsg-1.3+lenny1_all.deb


• Debian openswan_2.4.12+dfsg-1.3+lenny1_armel.deb
  http://security.debian.org/pool/updates/main/o/openswan/openswan_2.4.1 2+dfsg-1.3+lenny1_armel.deb

Debian Linux 5.0

• Debian linux-patch-openswan_2.4.12+dfsg-1.3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/o/openswan/linux-patch-op enswan_2.4.12+dfsg-1.3+lenny1_all.deb


• Debian openswan-modules-source_2.4.12+dfsg-1.3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/o/openswan/openswan-modul es-source_2.4.12+dfsg-1.3+lenny1_all.deb

Debian Linux 4.0

• Debian linux-patch-openswan_2.4.6+dfsg.2-1.1+etch1_all.deb
  http://security.debian.org/pool/updates/main/o/openswan/linux-patch-op enswan_2.4.6+dfsg.2-1.1+etch1_all.deb


• Debian openswan-modules-source_2.4.6+dfsg.2-1.1+etch1_all.deb
  http://security.debian.org/pool/updates/main/o/openswan/openswan-modul es-source_2.4.6+dfsg.2-1.1+etch1_all.deb

Debian Linux 4.0 mipsel

• Debian linux-patch-openswan_2.4.6+dfsg.2-1.1+etch1_all.deb
  http://security.debian.org/pool/updates/main/o/openswan/linux-patch-op enswan_2.4.6+dfsg.2-1.1+etch1_all.deb


• Debian openswan-modules-source_2.4.6+dfsg.2-1.1+etch1_all.deb
  http://security.debian.org/pool/updates/main/o/openswan/openswan-modul es-source_2.4.6+dfsg.2-1.1+etch1_all.deb


• Debian openswan_2.4.6+dfsg.2-1.1+etch1_mipsel.deb
  http://security.debian.org/pool/updates/main/o/openswan/openswan_2.4.6 +dfsg.2-1.1+etch1_mipsel.deb

Debian Linux 5.0 amd64

• Debian linux-patch-openswan_2.4.12+dfsg-1.3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/o/openswan/linux-patch-op enswan_2.4.12+dfsg-1.3+lenny1_all.deb


• Debian openswan-modules-source_2.4.12+dfsg-1.3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/o/openswan/openswan-modul es-source_2.4.12+dfsg-1.3+lenny1_all.deb


• Debian openswan_2.4.12+dfsg-1.3+lenny1_amd64.deb
  http://security.debian.org/pool/updates/main/o/openswan/openswan_2.4.1 2+dfsg-1.3+lenny1_amd64.deb

Debian Linux 5.0 mips

• Debian linux-patch-openswan_2.4.12+dfsg-1.3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/o/openswan/linux-patch-op enswan_2.4.12+dfsg-1.3+lenny1_all.deb


• Debian openswan-modules-source_2.4.12+dfsg-1.3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/o/openswan/openswan-modul es-source_2.4.12+dfsg-1.3+lenny1_all.deb


• Debian openswan_2.4.12+dfsg-1.3+lenny1_mips.deb
  http://security.debian.org/pool/updates/main/o/openswan/openswan_2.4.1 2+dfsg-1.3+lenny1_mips.deb

Debian Linux 5.0 powerpc

• Debian linux-patch-openswan_2.4.12+dfsg-1.3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/o/openswan/linux-patch-op enswan_2.4.12+dfsg-1.3+lenny1_all.deb


• Debian openswan-modules-source_2.4.12+dfsg-1.3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/o/openswan/openswan-modul es-source_2.4.12+dfsg-1.3+lenny1_all.deb


• Debian openswan_2.4.12+dfsg-1.3+lenny1_powerpc.deb
  http://security.debian.org/pool/updates/main/o/openswan/openswan_2.4.1 2+dfsg-1.3+lenny1_powerpc.deb

Debian Linux 4.0 ia-64

• Debian linux-patch-openswan_2.4.6+dfsg.2-1.1+etch1_all.deb
  http://security.debian.org/pool/updates/main/o/openswan/linux-patch-op enswan_2.4.6+dfsg.2-1.1+etch1_all.deb


• Debian openswan-modules-source_2.4.6+dfsg.2-1.1+etch1_all.deb
  http://security.debian.org/pool/updates/main/o/openswan/openswan-modul es-source_2.4.6+dfsg.2-1.1+etch1_all.deb


• Debian openswan_2.4.6+dfsg.2-1.1+etch1_ia64.deb
  http://security.debian.org/pool/updates/main/o/openswan/openswan_2.4.6 +dfsg.2-1.1+etch1_ia64.deb

Debian Linux 4.0 mips

• Debian linux-patch-openswan_2.4.6+dfsg.2-1.1+etch1_all.deb
  http://security.debian.org/pool/updates/main/o/openswan/linux-patch-op enswan_2.4.6+dfsg.2-1.1+etch1_all.deb


• Debian openswan-modules-source_2.4.6+dfsg.2-1.1+etch1_all.deb
  http://security.debian.org/pool/updates/main/o/openswan/openswan-modul es-source_2.4.6+dfsg.2-1.1+etch1_all.deb


• Debian openswan_2.4.6+dfsg.2-1.1+etch1_mips.deb
  http://security.debian.org/pool/updates/main/o/openswan/openswan_2.4.6 +dfsg.2-1.1+etch1_mips.deb

Debian Linux 5.0 sparc

• Debian linux-patch-openswan_2.4.12+dfsg-1.3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/o/openswan/linux-patch-op enswan_2.4.12+dfsg-1.3+lenny1_all.deb


• Debian openswan-modules-source_2.4.12+dfsg-1.3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/o/openswan/openswan-modul es-source_2.4.12+dfsg-1.3+lenny1_all.deb


• Debian openswan_2.4.12+dfsg-1.3+lenny1_sparc.deb
  http://security.debian.org/pool/updates/main/o/openswan/openswan_2.4.1 2+dfsg-1.3+lenny1_sparc.deb

Openswan IPsec Livetest Insecure Temporary File Creation Vulnerability

References:

• Bug 460425 - openswan: Insecure auxiliary /tmp file usage (symlink attack possi (Red Hat)
  
• Debian Bug report logs - #496421 (Debian)
  
• The possibility of attack with the help of symlinks in some Debian packages ("Dmitry E. Oboukhov" )
  
• Re: [ GLSA 200903-18 ] Openswan: Insecure temporary file creation (Paul Wouters )
  
• Re: [ GLSA 200903-18 ] Openswan: Insecure temporary file creation (Robert Buchholz )