CVE-2008-4190

MediumCVSS 4.4/10Last modified Jun 16, 2026

Description

The IPSEC livetest tool in Openswan 2.4.12 and earlier, and 2.6.x through 2.6.16, allows local users to overwrite arbitrary files and execute arbitrary code via a symlink attack on the (1) ipseclive.conn and (2) ipsec.olts.remote.log temporary files. NOTE: in many distributions and the upstream version, this tool has been disabled.

Metrics

CVSS 2.0 4.4/10AV:L/AC:M/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-59

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

Timeline

Published: Sep 24, 2008
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2008

CVE-2008-41916.6extract-table.pl in Emacspeak 26 and 28 allows local users to overwrite arbitrary files via a symlink attack on the extract-table.csv tempor CVE-2008-41926.9The pserver_shutdown function in fence_egenera in cman 2.20080629 and 2.20080801 allows local users to overwrite arbitrary files via a symli CVE-2008-419310.0Stack-based buffer overflow in SecurityGateway.dll in Alt-N Technologies SecurityGateway 1.0.1 allows remote attackers to execute arbitrary CVE-2008-41945.0The p_exec_query function in src/dns_query.c in pdnsd before 1.2.7-par allows remote attackers to cause a denial of service (daemon crash) v CVE-2008-41955.0Opera before 9.52 does not properly restrict the ability of a framed web page to change the address associated with a different frame, which CVE-2008-41964.3Cross-site scripting (XSS) vulnerability in Opera before 9.52 allows remote attackers to inject arbitrary web script or HTML via unspecified CVE-2008-41978.8Opera before 9.52 on Windows, Linux, FreeBSD, and Solaris, when processing custom shortcut and menu commands, can produce argument strings t CVE-2008-41985.0Opera before 9.52, when rendering an http page that has loaded an https page into a frame, displays a padlock icon and offers a security inf CVE-2008-41995.0Opera before 9.52 does not prevent use of links from web pages to feed source files on the local disk, which might allow remote attackers to CVE-2008-42006.4Opera before 9.52 does not ensure that the address field of a news feed represents the feed's actual URL, which allows remote attackers to c CVE-2008-42019.3Heap-based buffer overflow in the decodeMP4file function (frontend/main.c) in FAAD2 2.6.1 and earlier allows remote attackers to cause a den CVE-2008-42027.5SQL injection vulnerability in index.php in Gonafish LinksCaffePRO 4.5 allows remote attackers to execute arbitrary SQL commands via the idd