CVE-2008-4190: Openswan

Medium severity, CVSS 4.4. EPSS: 1.1% chance of exploitation in the next 30 days.

The IPSEC livetest tool in Openswan 2.4.12 and earlier, and 2.6.x through 2.6.16, allows local users to overwrite arbitrary files and execute arbitrary code via a symlink attack on the (1) ipseclive.conn and (2) ipsec.olts.remote.log temporary files. NOTE: in many distributions and the upstream version, this tool has been disabled.

Affected products

• Openswan Openswan: version 1.0.4 only; version 1.0.5 only; version 1.0.6 only; version 1.0.7 only; version 1.0.8 only; version 1.0.9 only; …
• Xelerance Openswan: version 2.3.1 only; version 2.4.0 only; version 2.4.2 only; version 2.4.4 only; version 2.6.03 only; version 2.6.04 only; …

Published 2008-09-24. Last modified 2026-06-16.