Unscored severity · published Dec 6, 2004
CVE-2004-0590
FreeS/WAN 1.x and 2.x, and other related products including superfreeswan 1.x, openswan 1.x before 1.0.6, openswan 2.x before 2.1.4, and strongSwan before 2.1.3, allows remote…
–
CVSS
2.8%
EPSS
No
On KEV
Description
FreeS/WAN 1.x and 2.x, and other related products including superfreeswan 1.x, openswan 1.x before 1.0.6, openswan 2.x before 2.1.4, and strongSwan before 2.1.3, allows remote attackers to authenticate using spoofed PKCS#7 certificates in which a self-signed certificate identifies an alternate Certificate Authority (CA) and spoofed issuer and subject.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.8% · higher than 87% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FW
Frees Wan · Frees Wan
1; 2 · source: NVD
OP
Openswan · Openswan
1; 2 · source: NVD
ST
Strongswan · Strongswan
through 2.1.2 · source: NVD
SF
Super Frees Wan · Frees Wan
1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2004-0590
CVE.org
https://www.cve.org/CVERecord?id=CVE-2004-0590
Patch
http://security.gentoo.org/glsa/glsa-200406-20.xml
Patch
http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2004:070
Patch
http://www.openswan.org/support/vuln/can-2004-0590/
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/16515
More from Frees Wan
–
CVE-2005-3671
The Internet Key Exchange version 1 (IKEv1) implementation in Openswan 2 (openswan-2) before 2.4.4, and freeswan in SUSE LINUX 9.1 before 2.04_1.5.4-1.23, allow remote attackers…
–
CVE-2002-0666
IPSEC implementations including (1) FreeS/WAN and (2) KAME do not properly calculate the length of authentication data, which allows remote attackers to cause a denial of service…