CVE-2018-10900: OS Command Injection
Network Manager VPNC plugin (aka networkmanager-vpnc) before version 1.2.6 is vulnerable to a privilege escalation attack. A new line character can be used to inject a Password helper parameter into the configuration data passed to VPNC, allowing an attacker to execute arbitrary commands as root.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2018-10900?
CVE-2018-10900 has a high severity rating due to its potential for privilege escalation.
How do I fix CVE-2018-10900?
To fix CVE-2018-10900, update the Network Manager VPNC plugin to a version 1.2.6 or higher.
What systems are affected by CVE-2018-10900?
CVE-2018-10900 affects versions of the Network Manager VPNC plugin prior to 1.2.6 on Debian systems.
What type of attack is associated with CVE-2018-10900?
CVE-2018-10900 is associated with a privilege escalation attack that involves injecting malicious configuration data.
What can attackers achieve by exploiting CVE-2018-10900?
By exploiting CVE-2018-10900, attackers can execute arbitrary commands on the system as root.