programs/pluto/xauth.c in the client in Openswan 2.6.25 through 2.6.28 allows remote authenticated gateways to execute arbitrary commands via shell metacharacters in (1) cisco_dns_info or (2) cisco_domain_info data in a packet, a different vulnerability than CVE-2010-3302.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2010-0892 advisory.

    [2.6.24-8.1]     Resolves: #635058 CVE-2010-3302 CVE-2010-3308                       CVE-2010-2752 CVE-2010-3753

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Two buffer overflow flaws were found in the Openswan client-side XAUTH handling code used when connecting to certain Cisco gateways. A malicious or compromised VPN gateway could use these flaws to execute arbitrary code on the connecting Openswan client. (CVE-2010-3302, CVE-2010-3308)

Two input sanitization flaws were found in the Openswan client-side handling of Cisco gateway banners. A malicious or compromised VPN gateway could use these flaws to execute arbitrary code on the connecting Openswan client. (CVE-2010-3752, CVE-2010-3753)

After installing this update, the ipsec service will be restarted automatically.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2010:0892 advisory.

    Openswan is a free implementation of Internet Protocol Security (IPsec)     and Internet Key Exchange (IKE). IPsec uses strong cryptography to provide     both authentication and encryption services. These services allow you to     build secure tunnels through untrusted networks.

    Two buffer overflow flaws were found in the Openswan client-side XAUTH     handling code used when connecting to certain Cisco gateways. A malicious     or compromised VPN gateway could use these flaws to execute arbitrary code     on the connecting Openswan client. (CVE-2010-3302, CVE-2010-3308)

    Two input sanitization flaws were found in the Openswan client-side     handling of Cisco gateway banners. A malicious or compromised VPN gateway     could use these flaws to execute arbitrary code on the connecting Openswan     client. (CVE-2010-3752, CVE-2010-3753)

    Red Hat would like to thank the Openswan project for reporting these     issues. Upstream acknowledges D. Hugh Redelmeier and Paul Wouters as the     original reporters.

    All users of openswan are advised to upgrade to these updated packages,     which contain backported patches to correct these issues. After installing     this update, the ipsec service will be restarted automatically.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
68145	Oracle Linux 6 : openswan (ELSA-2010-0892)	Nessus	Oracle Linux Local Security Checks	critical
60900	Scientific Linux Security Update : openswan on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
50645	RHEL 6 : openswan (RHSA-2010:0892)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2010-3752

critical

Tenable Plugins

critical

medium

critical