CVE-2004-0590 FreeS/WAN 1.x and 2.x, and other related products including superfreeswan 1.x, openswan 1.x before 1.0.6, openswan 2.x before 2.1.4, and strongSwan before 2.1.3, allows remote attackers to authenticat...
HighCVSS 10.0
EPSS 2.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
FreeS/WAN 1.x and 2.x, and other related products including superfreeswan 1.x, openswan 1.x before 1.0.6, openswan 2.x before 2.1.4, and strongSwan before 2.1.3, allows remote attackers to authenticate using spoofed PKCS#7 certificates in which a self-signed certificate identifies an alternate Certificate Authority (CA) and spoofed issuer and subject.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| frees wan | = 1 | No fix listed |
| frees wan | = 2 | No fix listed |
| frees wan super frees wan | = 1 | No fix listed |
| openswan | = 1 | No fix listed |
| openswan | = 2 | No fix listed |
| strongSwan | <= 2.1.2 | No fix listed |
References
- GLSA-200406-20 patch vendor-advisory
- MDKSA-2004:070 patch vendor-advisory
- www.openswan.org patch vendor-advisory
- ipsec-verifyx509cert-auth-bypass(16515) vdb-entry