Unscored severity · published Jan 26, 2005
CVE-2005-0162
Stack-based buffer overflow in the get_internal_addresses function in the pluto application for Openswan 1.x before 1.0.9, and Openswan 2.x before 2.3.0, when compiled with XAUTH…
–
CVSS
1.7%
EPSS
No
On KEV
Description
Stack-based buffer overflow in the get_internal_addresses function in the pluto application for Openswan 1.x before 1.0.9, and Openswan 2.x before 2.3.0, when compiled with XAUTH and PAM enabled, allows remote authenticated attackers to execute arbitrary code.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Openswan · Openswan
through 1.0.9 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2005-0162
CVE.org
https://www.cve.org/CVERecord?id=CVE-2005-0162
secunia.com
http://secunia.com/advisories/14038
secunia.com
http://secunia.com/advisories/14062
securitytracker.com
http://securitytracker.com/id?1013014
Patch
http://www.idefense.com/application/poi/display?id=190&type=vulnerabilities
Patch
http://www.openswan.org/support/vuln/IDEF0785/
www.osvdb.org
http://www.osvdb.org/13195
More from Openswan
–
CVE-2011-2147
Openswan 2.2.x does not properly restrict permissions for (1) /var/run/starter.pid, related to starter.c in the IPsec starter, and (2) /var/lock/subsys/ipsec, which allows local…
–
CVE-2008-4190
The IPSEC livetest tool in Openswan 2.4.12 and earlier, and 2.6.x through 2.6.16, allows local users to overwrite arbitrary files and execute arbitrary code via a symlink attack…
–
CVE-2005-3671
The Internet Key Exchange version 1 (IKEv1) implementation in Openswan 2 (openswan-2) before 2.4.4, and freeswan in SUSE LINUX 9.1 before 2.04_1.5.4-1.23, allow remote attackers…
–
CVE-2004-0590
FreeS/WAN 1.x and 2.x, and other related products including superfreeswan 1.x, openswan 1.x before 1.0.6, openswan 2.x before 2.1.4, and strongSwan before 2.1.3, allows remote…