Description
Network Manager VPNC plugin (aka networkmanager-vpnc) before version 1.2.6 is vulnerable to a privilege escalation attack. A new line character can be used to inject a Password helper parameter into the configuration data passed to VPNC, allowing an attacker to execute arbitrary commands as root.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
[UNKNOWN] networkmanager-vpnc
NetworkManager-vpnc 1.2.6affected
References
- https://www.debian.org/security/2018/dsa-4253 ↗
- https://security.gentoo.org/glsa/201808-03 ↗
- https://lists.debian.org/debian-lts-announce/2018/07/msg00048.html ↗
- https://www.exploit-db.com/exploits/45313/ ↗
- https://pulsesecurity.co.nz/advisories/NM-VPNC-Privesc ↗
- https://gitlab.gnome.org/GNOME/NetworkManager-vpnc/commit/07ac18a32b4 ↗
- https://bugzilla.novell.com/show_bug.cgi?id=1101147 ↗
- https://download.gnome.org/sources/NetworkManager-vpnc/1.2/NetworkManager-vpnc-1.2.6.news ↗
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10900 ↗