CVE-2010-2628

The IKE daemon in strongSwan 4.3.x before 4.3.7 and 4.4.x before 4.4.1 does not properly check the return values of snprintf calls, which allows remote attackers to execute arbitrary code via crafted (1) certificate or (2) identity data that triggers buffer overflows.

• CWE-94

• http://download.strongswan.org/patches/08_snprintf_patch/strongswan-4.3.3_snprintf.patchPatch
• http://download.strongswan.org/patches/08_snprintf_patch/strongswan-4.3.4_snprintf.patchPatch
• http://download.strongswan.org/patches/08_snprintf_patch/strongswan-4.3.5_snprintf.patchPatch
• http://download.strongswan.org/patches/08_snprintf_patch/strongswan-4.3.6_snprintf.patchPatch
• http://download.strongswan.org/patches/08_snprintf_patch/strongswan-4.4.0_snprintf.patchPatch
• http://lists.opensuse.org/opensuse-updates/2010-08/msg00026.html
• http://secunia.com/advisories/40956Vendor Advisory
• http://trac.strongswan.org/projects/strongswan/wiki/441
• http://www.securityfocus.com/bid/42444Patch
• http://www.securitytracker.com/id?1024338
• http://www.vupen.com/english/advisories/2010/2085Patch, Vendor Advisory
• http://www.vupen.com/english/advisories/2010/2086
• https://bugzilla.novell.com/615915
• https://lists.strongswan.org/pipermail/users/2010-August/005167.htmlPatch, Vendor Advisory
• http://download.strongswan.org/patches/08_snprintf_patch/strongswan-4.3.3_snprintf.patchPatch
• http://download.strongswan.org/patches/08_snprintf_patch/strongswan-4.3.4_snprintf.patchPatch
• http://download.strongswan.org/patches/08_snprintf_patch/strongswan-4.3.5_snprintf.patchPatch
• http://download.strongswan.org/patches/08_snprintf_patch/strongswan-4.3.6_snprintf.patchPatch
• http://download.strongswan.org/patches/08_snprintf_patch/strongswan-4.4.0_snprintf.patchPatch
• http://lists.opensuse.org/opensuse-updates/2010-08/msg00026.html
• http://secunia.com/advisories/40956Vendor Advisory
• http://trac.strongswan.org/projects/strongswan/wiki/441
• http://www.securityfocus.com/bid/42444Patch
• http://www.securitytracker.com/id?1024338
• http://www.vupen.com/english/advisories/2010/2085Patch, Vendor Advisory
• http://www.vupen.com/english/advisories/2010/2086
• https://bugzilla.novell.com/615915
• https://lists.strongswan.org/pipermail/users/2010-August/005167.htmlPatch, Vendor Advisory

Published

Aug 20, 2010

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2010-2622SQL injection vulnerability in the Joomanager component, pos…
• CVE-2010-2623SQL injection vulnerability in pages.php in Internet DM Spec…
• CVE-2010-2624Multiple SQL injection vulnerabilities in iScripts EasySnaps…
• CVE-2010-2625Unspecified vulnerability in the Client Service for DPM in H…
• CVE-2010-2626index.pl in Miyabi CGI Tools SEO Links 1.02 allows remote at…
• CVE-2010-2627Multiple directory traversal vulnerabilities in the Refracto…
• CVE-2010-2629The Cisco Content Services Switch (CSS) 11500 with software …
• CVE-2010-2630The TIFFReadDirectory function in LibTIFF 3.9.0 does not pro…
• CVE-2010-2631LibTIFF 3.9.0 ignores tags in certain situations during the …
• CVE-2010-2632Unspecified vulnerability in the FTP Server in Oracle Solari…
• CVE-2010-2633Unspecified vulnerability in EMC Disk Library (EDL) before 3…
• CVE-2010-2634RSA enVision before 3.7 SP1 allows remote authenticated user…