CVE-2017-6590
First published: Thu Mar 09 2017(Updated: )
An issue was discovered in network-manager-applet (aka network-manager-gnome) in Ubuntu 12.04 LTS, 14.04 LTS, 16.04 LTS, and 16.10. A local attacker could use this issue at the default Ubuntu login screen to access local files and execute arbitrary commands as the lightdm user. The exploitation requires physical access to the locked computer and the Wi-Fi must be turned on. An access point that lets you use a certificate to login is required as well, but it's easy to create one. Then, it's possible to open a nautilus window and browse directories. One also can open some applications such as Firefox, which is useful for downloading malicious binaries.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Ubuntu | =12.04 | |
| Ubuntu | =14.04 | |
| Ubuntu | =16.04 | |
| Ubuntu | =16.10 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2017-6590?
CVE-2017-6590 has a medium severity rating due to its potential for local file access and command execution.
How do I fix CVE-2017-6590?
To fix CVE-2017-6590, upgrade to a patched version of network-manager-applet available in the Ubuntu repositories.
Who is affected by CVE-2017-6590?
CVE-2017-6590 affects local users on Ubuntu 12.04 LTS, 14.04 LTS, 16.04 LTS, and 16.10 systems.
What can an attacker do with CVE-2017-6590?
An attacker can access local files and execute arbitrary commands as the lightdm user through the default Ubuntu login screen.
Is CVE-2017-6590 a remote attack vulnerability?
No, CVE-2017-6590 requires local access to the system, making it a local attack vulnerability.
- agent/type
- agent/remedy
- agent/last-modified-date
- agent/first-publish-date
- agent/severity
- agent/references
- agent/weakness
- agent/author
- agent/tags
- agent/softwarecombine
- agent/description
- agent/event
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/canonical
- canonical/ubuntu
- version/ubuntu/12.04
- version/ubuntu/14.04
- version/ubuntu/16.04
- version/ubuntu/16.10