CVE-2018-18556: Input Validation

Published Dec 17, 2018

Updated

A privilege escalation issue was discovered in VyOS 1.1.8. The default configuration also allows operator users to execute the pppd binary with elevated (sudo) permissions. Certain input parameters are not properly validated. A malicious operator user can run the binary with elevated permissions and leverage its improper input validation condition to spawn an attacker-controlled shell with root privileges.

Affected Software

1 affected component

VyOS VyOS=1.1.8

Event History

Dec 17, 2018

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2018-18556?

The severity of CVE-2018-18556 is considered high due to the potential for privilege escalation.

How do I fix CVE-2018-18556?

To fix CVE-2018-18556, upgrade to a patched version of VyOS that addresses the privilege escalation issue.

Who is affected by CVE-2018-18556?

Users of VyOS version 1.1.8 are affected by CVE-2018-18556.

What kind of vulnerability is CVE-2018-18556?

CVE-2018-18556 is a privilege escalation vulnerability.

Can operator users exploit CVE-2018-18556?

Yes, a malicious operator user can exploit CVE-2018-18556 to gain elevated permissions.