Network Manager VPNC plugin (aka networkmanager-vpnc) before version 1.2.6 is vulnerable to a privilege escalation attack. A new line character can be used to inject a Password helper parameter into the configuration data passed to VPNC, allowing an attacker to execute arbitrary commands as root.

Update to 1.2.6 to fix a local authenticated privilege escalation bug (CVE-2018-10900).

The issue has been discovered and responsibly disclosed by Denis Andzakovic: https://pulsesecurity.co.nz/advisories/NM-VPNC-Privesc

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201808-03 (NetworkManager VPNC plugin: Privilege escalation)

    When initiating a VPNC connection, NetworkManager spawns a new vpnc       process and passes the configuration via STDIN. By injecting a special       character into a configuration parameter, an attacker can coerce       NetworkManager to set the Password helper option to an attacker       controlled executable file.
  Impact :

    A local attacker is able to escalate privileges via a specially crafted       configuration file.
  Workaround :

    There is no known workaround at this time.

This update for NetworkManager-vpnc fixes the following issues :

Security issue fixed :

  - CVE-2018-10900: Check configurations that contain     newline characters and invalidate them to avoid security     attacks (bsc#1101147).

This update was imported from the SUSE:SLE-12-SP2:Update update project.

This update for NetworkManager-vpnc fixes the following issues:
Security issue fixed :

  - CVE-2018-10900: Check configurations that contain     newline characters and invalidate them to avoid security     attacks (bsc#1101147).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Denis Andzakovic discovered that network-manager-vpnc, a plugin to provide VPNC support for NetworkManager, is prone to a privilege escalation vulnerability. A newline character can be used to inject a Password helper parameter into the configuration data passed to vpnc, allowing a local user with privileges to modify a system connection to execute arbitrary commands as root.

For Debian 8 'Jessie', this problem has been fixed in version 0.9.10.0-1+deb8u1.

We recommend that you upgrade your network-manager-vpnc packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Denis Andzakovic discovered that network-manager-vpnc, a plugin to provide VPNC support for NetworkManager, is prone to a privilege escalation vulnerability. A newline character can be used to inject a Password helper parameter into the configuration data passed to vpnc, allowing a local user with privileges to modify a system connection to execute arbitrary commands as root.

ID	Name	Product	Family	Severity
120880	Fedora 28 : 1:NetworkManager-vpnc (2018-eb5ea0abaf)	Nessus	Fedora Local Security Checks	high
112077	GLSA-201808-03 : NetworkManager VPNC plugin: Privilege escalation	Nessus	Gentoo Local Security Checks	high
111779	openSUSE Security Update : NetworkManager-vpnc (openSUSE-2018-859)	Nessus	SuSE Local Security Checks	high
111662	SUSE SLED12 Security Update : Recommended update for NetworkManager-vpnc (SUSE-SU-2018:2297-1)	Nessus	SuSE Local Security Checks	high
111467	Debian DLA-1454-1 : network-manager-vpnc security update	Nessus	Debian Local Security Checks	high
111361	Fedora 27 : 1:NetworkManager-vpnc (2018-ac02463f82)	Nessus	Fedora Local Security Checks	high
111234	Debian DSA-4253-1 : network-manager-vpnc - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2018-10900

high

Tenable Plugins

high

high

high

high

high

high

high