
CVE-2010-3302: Openswan cisco DNS option handling vulnerability
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2010-3302

See also: CVE-2010-3308 Openswan cisco banner option handling vulnerability
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2010-3308

Security Alert:
This alert (and any possible updates) is available at the following URL:
http://www.openswan.org/download/CVE-2010-3302/

The Openswan project has discovered a vulnerability in the XAUTH
Cisco handling code that could be exploited if openswan connects to a
trusted gateway that has been compromised.

Vulnerable versions: openswan 2.6.25 up to and including openswan 2.6.28
Fixed version      : openswan 2.6.29 and above

Vulnerability information:
In very specific circumstances, a buffer overflow and arbitrary shell
commands could be sent to a vulnerable openswan client.

These vulnerabilities can only be triggered when openswan is configured to
connect to a malicious Cisco compatible gateway using XAUTH. It requires
openswan to be configured with *xauthclient=yes and remote_peer_type=cisco,
and requires successful phase1 IKE negotiation. This can only happen to a
vulnerable Openswan client when connecting to a trusted and authenticated
gateway using XAUTH.

An Openswan server receiving VPN connections is not affected by this flaw.

Vulnerability Details:
The fields cisco_dns_info and cisco_domain_info were declared as a fixed
length buffer. If enough DNS payloads are sent in one packet, the buffer will
overflow. Additionally, these fields were copied into fmt_common_shell_out()
without being sanitized to make it safe against exploitable characters,
such as single quotes('). This was introduced in git commit id 3115ee29,
on March 19, 2010 and first released in openswan 2.6.25. The vulnerability
is fixed in openswan 2.6.29.

Patch:
For those unable to upgrade to the latest openswan 2.6.29 release, a patch
addressing CVE-2010-3302 (and CVE-2010-3308) can be found at:
http://www.openswan.org/download/CVE-2010-330x/

Full release:
The latest openswan release which fixes all known issues can be found at:
http://www.openswan.org/download/openswan-2.6.29.tar.gz
http://www.openswan.org/download/openswan-2.6.29.tar.gz.asc (GPG signature)

Credit:
These vulnerabilities were found by D. Hugh Redelmeier <hugh@mimosa.com>
and Paul Wouters <paul@xelerance.com>

About openswan (http://www.openswan.org/):
Openswan is a free implementation of Internet Protocol Security (IPsec)
and Internet Key Exchange (IKE). IPsec uses strong cryptography to provide
both authentication and encryption services. These services allow you to
build secure tunnels through untrusted networks. Everything passing through
the untrusted network is encrypted by the IPsec gateway machine, and
decrypted by the gateway at the other end of the tunnel. The resulting
tunnel is a virtual private network (VPN).

About Xelerance (http://www.xelerance.com/):
Xelerance is the custodian of the openswan IPsec software and the L2TP
server xl2tpd. These are used in combination to provide Enterprise VPN
solutions.  Headquartered in Ottawa, the high-tech capital of Canada,
Xelerance provides products and services to secure the internet. Its
products include DNSX Secure Signer, which won the Best Security Hardware
award at FOSE 2010, and DNSX Secure Resolver.
