CVE-2010-3752
Openswan 2.6.25-2.6.28 - Authenticated OS Command Injection via cisco_dns_info or cisco_domain_info
Title source: llmDescription
programs/pluto/xauth.c in the client in Openswan 2.6.25 through 2.6.28 allows remote authenticated gateways to execute arbitrary commands via shell metacharacters in (1) cisco_dns_info or (2) cisco_domain_info data in a packet, a different vulnerability than CVE-2010-3302.
References (7)
Core 7
Core References
Vendor Advisory vdb-entry
x_refsource_vupen
http://www.vupen.com/english/advisories/2010/2526
Vendor Advisory x_refsource_confirm
http://www.openswan.org/download/CVE-2010-3302/CVE-2010-3302.txt
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/43588
Vendor Advisory vendor-advisory
x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2010-0892.html
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://www.securitytracker.com/id?1024749
Patch x_refsource_confirm
http://www.openswan.org/download/CVE-2010-3308/openswan-2.6.26-2.6.28-CVE-2010-330x.patch
Patch x_refsource_confirm
http://www.openswan.org/download/CVE-2010-3302/openswan-2.6.25-CVE-2010-3302.patch
Scores
EPSS
0.0246
EPSS Percentile
82.5%
Details
CWE
CWE-78
Status
published
Products (4)
xelerance/openswan
2.6.25
xelerance/openswan
2.6.26
xelerance/openswan
2.6.27
xelerance/openswan
2.6.28
Published
Oct 05, 2010
Tracked Since
Feb 18, 2026