CVE-2010-2628

CVSS V2 High 7.5 CVSS V3 None
Description
The IKE daemon in strongSwan 4.3.x before 4.3.7 and 4.4.x before 4.4.1 does not properly check the return values of snprintf calls, which allows remote attackers to execute arbitrary code via crafted (1) certificate or (2) identity data that triggers buffer overflows.
Overview
  • CVE ID
  • CVE-2010-2628
  • Assigner
  • cve@mitre.org
  • Vulnerability Status
  • Modified
  • Published Version
  • 2010-08-20T18:00:02
  • Last Modified Date
  • 2010-08-24T05:46:34
Weakness Enumerations
CWE URL
CWE-94 http://cwe.mitre.org/data/definitions/94.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:a:strongswan:strongswan:4.3.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:strongswan:strongswan:4.3.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:strongswan:strongswan:4.3.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:strongswan:strongswan:4.3.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:strongswan:strongswan:4.3.4:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:strongswan:strongswan:4.3.5:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:strongswan:strongswan:4.3.6:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:strongswan:strongswan:4.4.0:*:*:*:*:*:*:* 1 OR
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:N/AC:L/Au:N/C:P/I:P/A:P
  • Access Vector
  • NETWORK
  • Access Compatibility
  • LOW
  • Authentication
  • NONE
  • Confidentiality Impact
  • PARTIAL
  • Integrity Impact
  • PARTIAL
  • Availability Impact
  • PARTIAL
  • Base Score
  • 7.5
  • Severity
  • HIGH
  • Exploitability Score
  • 10
  • Impact Score
  • 6.4
References
Reference URL Reference Tags
http://download.strongswan.org/patches/08_snprintf_patch/strongswan-4.3.6_snprintf.patch Patch
http://download.strongswan.org/patches/08_snprintf_patch/strongswan-4.3.3_snprintf.patch Patch
http://www.vupen.com/english/advisories/2010/2085 Patch Vendor Advisory
http://trac.strongswan.org/projects/strongswan/wiki/441
http://download.strongswan.org/patches/08_snprintf_patch/strongswan-4.4.0_snprintf.patch Patch
http://secunia.com/advisories/40956 Vendor Advisory
https://lists.strongswan.org/pipermail/users/2010-August/005167.html Patch Vendor Advisory
http://www.securityfocus.com/bid/42444 Patch
https://bugzilla.novell.com/615915
http://lists.opensuse.org/opensuse-updates/2010-08/msg00026.html
http://download.strongswan.org/patches/08_snprintf_patch/strongswan-4.3.4_snprintf.patch Patch
http://download.strongswan.org/patches/08_snprintf_patch/strongswan-4.3.5_snprintf.patch Patch
http://www.vupen.com/english/advisories/2010/2086
http://www.securitytracker.com/id?1024338
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2010-2628
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2628
History
Created Old Value New Value Data Type Notes
2022-05-10 11:09:33 Added to TrackCVE