CVE-2005-0162

Stack-based buffer overflow in the get_internal_addresses function in the pluto application for Openswan 1.x before 1.0.9, and Openswan 2.x before 2.3.0, when compiled with XAUTH and PAM enabled, allows remote authenticated attackers to execute arbitrary code.

CVSS v2.0 7.2 HIGH

7.2^/10

CVSS v2.0 : HIGH

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://secunia.com/advisories/14038
http://secunia.com/advisories/14062
http://securitytracker.com/id?1013014
http://www.idefense.com/application/poi/display?id=190&type=vulnerabilities	Patch Vendor Advisory
http://www.openswan.org/support/vuln/IDEF0785/	Patch Vendor Advisory
http://www.osvdb.org/13195
http://www.redhat.com/archives/fedora-announce-list/2005-January/msg00103.html
http://www.securityfocus.com/bid/12377
https://exchange.xforce.ibmcloud.com/vulnerabilities/19078

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:openswan:openswan::::::::
	cpe:2.3:a:xelerance:openswan:2.3.0:::::::*

History

No history.

Information

Published : 2005-01-26 05:00

Updated : 2019-07-29 13:23

NVD link : CVE-2005-0162

Mitre link : CVE-2005-0162

CVE.ORG link : CVE-2005-0162

JSON object : View

Products Affected

xelerance

openswan

openswan

openswan

CWE

NVD-CWE-Other

{"id": "CVE-2005-0162", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": true, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2005-01-26T05:00:00.000", "references": [{"url": "http://secunia.com/advisories/14038", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/14062", "source": "cve@mitre.org"}, {"url": "http://securitytracker.com/id?1013014", "source": "cve@mitre.org"}, {"url": "http://www.idefense.com/application/poi/display?id=190&type=vulnerabilities", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.openswan.org/support/vuln/IDEF0785/", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.osvdb.org/13195", "source": "cve@mitre.org"}, {"url": "http://www.redhat.com/archives/fedora-announce-list/2005-January/msg00103.html", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/12377", "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/19078", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Stack-based buffer overflow in the get_internal_addresses function in the pluto application for Openswan 1.x before 1.0.9, and Openswan 2.x before 2.3.0, when compiled with XAUTH and PAM enabled, allows remote authenticated attackers to execute arbitrary code."}], "lastModified": "2019-07-29T13:23:54.030", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openswan:openswan:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E2411B8B-FE2A-4E99-A280-0FB39291E96F", "versionEndIncluding": "1.0.9"}, {"criteria": "cpe:2.3:a:xelerance:openswan:2.3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "39C5F91B-EE8A-4A81-A21D-68A3F4295200"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}