I recently had to find a VPN client to connect to a preconfigured Cisco IPSec VPN. Of course there's Cisco's own client implementation AnyConnect, but I wanted to stick with a free alternative if possible. (Edit: I also just read that AnyConnect doesn't support IPSec in the first place.) Said and done I found a couple of applications, but it appears they're all rather old:
- For Windows there's mostly the famous Shrewsoft client. Its most recent release 2.2.2 dates back to July 1st, 2013.
- On Linux vpnc is probably the most widely known implementation. It seems like its original maintainers abandoned it after releasing version 0.5.3 on November 19th, 2008. Anyways, that version is still being taken care of by different communities, e.g. Debian most recently patched it to 0.5.3r550-3 on November 23rd, 2016.
- As a system-independent candidate let's add OpenConnect. Its most recent release is from December 13th, 2016.
Now for a widely used and security critical network application, I find it likely that vulnerabilities are found regularly and that security fixes are published every so often. However, I also realise that by now all these applications have had plenty of time to go through a lot of hardening. So here's my question:
How much of an issue is long update intervals for VPN clients like the ones mentioned above?