CVE-2004-0590

FreeS/WAN 1.x and 2.x, and other related products including superfreeswan 1.x, openswan 1.x before 1.0.6, openswan 2.x before 2.1.4, and strongSwan before 2.1.3, allows remote attackers to authenticate using spoofed PKCS#7 certificates in which a self-signed certificate identifies an alternate Certificate Authority (CA) and spoofed issuer and subject.

CVSS v2.0 10.0 HIGH

10.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://security.gentoo.org/glsa/glsa-200406-20.xml	Patch Vendor Advisory
http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2004:070	Patch Vendor Advisory
http://www.openswan.org/support/vuln/can-2004-0590/	Patch Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/16515

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:frees_wan:frees_wan:1:::::::*
	cpe:2.3:a:frees_wan:frees_wan:2:::::::*
	cpe:2.3:a:frees_wan:super_frees_wan:1:::::::*
	cpe:2.3:a:openswan:openswan:1:::::::*
	cpe:2.3:a:openswan:openswan:2:::::::*
	cpe:2.3:a:strongswan:strongswan::::::::

History

No history.

Information

Published : 2004-12-06 05:00

Updated : 2017-07-11 01:30

NVD link : CVE-2004-0590

Mitre link : CVE-2004-0590

CVE.ORG link : CVE-2004-0590

JSON object : View

Products Affected

openswan

openswan

strongswan

strongswan

frees_wan

super_frees_wan
frees_wan

CWE

NVD-CWE-Other

{"id": "CVE-2004-0590", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": true, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2004-12-06T05:00:00.000", "references": [{"url": "http://security.gentoo.org/glsa/glsa-200406-20.xml", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2004:070", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.openswan.org/support/vuln/can-2004-0590/", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16515", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "FreeS/WAN 1.x and 2.x, and other related products including superfreeswan 1.x, openswan 1.x before 1.0.6, openswan 2.x before 2.1.4, and strongSwan before 2.1.3, allows remote attackers to authenticate using spoofed PKCS#7 certificates in which a self-signed certificate identifies an alternate Certificate Authority (CA) and spoofed issuer and subject."}, {"lang": "es", "value": "FreeS/WAN 1.x y 2.x, y otros productos relacionados, incluyendo superfreeswan 1.x, openswan 1.x anteriores a 1.0.6, openswan 2.x anteriores a 2.1.4 y strongSwan anteriores a 2.1.3 permite a atacantes remotos autenticarse usando certificados PKCS#7 falsificados en los que un certificado auto-firmado identifica a una Autoridad Certificadora (CA) y a un usuario y asunto suplantados."}], "lastModified": "2017-07-11T01:30:17.277", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:frees_wan:frees_wan:1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "10B562DF-7470-4C26-9989-0872DA521B44"}, {"criteria": "cpe:2.3:a:frees_wan:frees_wan:2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E5B02427-164D-4B6B-ACF1-662691FC6828"}, {"criteria": "cpe:2.3:a:frees_wan:super_frees_wan:1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4C94B5FB-8830-4217-BB07-36DAD9902259"}, {"criteria": "cpe:2.3:a:openswan:openswan:1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "06740766-75C5-4EDA-8BFD-96C5E7AE1A73"}, {"criteria": "cpe:2.3:a:openswan:openswan:2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E54638CB-40EE-47D1-A373-1AEF85DE9405"}, {"criteria": "cpe:2.3:a:strongswan:strongswan:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D62594D0-8847-4CC4-9AFD-3C216D429C5B", "versionEndIncluding": "2.1.2"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}