#VU42171 Race condition in libreswan - CVE-2013-7283

Vulnerability identifier: #VU42171

Vulnerability risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2013-7283

CWE-ID: CWE-362

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
libreswan
Universal components / Libraries / Libraries used by multiple products

Vendor: libreswan.org

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Race condition in the libreswan.spec files for Red Hat Enterprise Linux (RHEL) and Fedora packages in libreswan 3.6 has unspecified impact and attack vectors, involving the /var/tmp/libreswan-nss-pwd temporary file.

Mitigation
Install update from vendor's website.

Vulnerable software versions

libreswan: 3.6

---

External links
https://secunia.com/advisories/56276
https://www.osvdb.org/101575
https://github.com/libreswan/libreswan/commit/ef2d756e73a188401c36133c2e2f7ce4f3c6ae55
https://lists.libreswan.org/pipermail/swan-announce/2013/000007.html

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.