Bug 637924 (CVE-2010-3308) - CVE-2010-3308 Openswan cisco banner option handling vulnerability
Summary: CVE-2010-3308 Openswan cisco banner option handling vulnerability
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2010-3308
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: public=20100927,reported=20100915,sou...
Depends On: 635058 635060 637925
Blocks:
TreeView+ depends on / blocked
 
Reported: 2010-09-27 18:43 UTC by Josh Bressers
Modified: 2019-06-08 13:06 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2010-11-16 20:02:07 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2010:0892 normal SHIPPED_LIVE Moderate: openswan security update 2010-11-16 18:17:34 UTC

Description Josh Bressers 2010-09-27 18:43:15 UTC
Security Alert:
This alert (and any possible updates) is available at the following URL:
http://www.openswan.org/download/CVE-2010-3302/

The Openswan project has discovered two vulnerabilities in the XAUTH
Cisco handling code that could be exploited if openswan connects to a
trusted gateway that has been compromised.

Vulnerable versions: openswan 2.6.26 up to and including openswan 2.6.28
Fixed version      : openswan 2.6.29 and above

Vulnerability information:
In very specific circumstances, a buffer overflow and arbitrary shell
commands could be sent to a vulnerable openswan client.

These vulnerabilities can only be triggered when openswan is configured to
connect to a malicious Cisco compatible gateway using XAUTH. It requires
openswan to be configured with *xauthclient=yes and remote_peer_type=cisco,
and requires successful phase1 IKE negotiation. This can only happen to a
vulnerable Openswan client when connecting to a trusted and authenticated
gateway using XAUTH.

An Openswan server receiving VPN connections is not affected by this flaw.

Vulnerability Details:
The field cisco_banner (later renamed to server_banner) were declared as a
fixed length buffer. If a banner is sent with more then 500 characters,
the buffer will overflow.  Additionally, the banner was copied
into fmt_common_shell_out() without being sanitized to make it safe
against exploitable characters, such as single quotes('). This was
introduced in git commit id 3615e17463a, on May 19, 2010 and first
released in openswan 2.6.26.

Patch:
For those unable to upgrade to the latest openswan 2.6.29 release, a patch
addressing CVE-2010-3308 and CVE-2010-3302 can be found at:
http://www.openswan.org/download/CVE-2010-330x/

Acknowledgements:

Red Hat would like to thank the Openswan project for reporting this issue.
Upstream acknowledges D. Hugh Redelmeier and Paul Wouters as the original
reporters.

Comment 2 Josh Bressers 2010-09-27 18:47:49 UTC
Created openswan tracking bugs for this issue

Affects: fedora-all [bug 637925]

Comment 3 errata-xmlrpc 2010-11-16 18:17:48 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2010:0892 https://rhn.redhat.com/errata/RHSA-2010-0892.html


Note You need to log in before you can comment on or make changes to this bug.