REDHAT-BUG-2533642: High severity NetworkManager NetworkManager-vpnc vulnerability
A privilege escalation flaw was found in NetworkManager-vpnc, the vpnc VPN plugin for NetworkManager. nm-vpnc-service validates plugin-specific VPN configuration items for embedded newline characters, but omits the top-level NMSettingVpn user-name property from this check. This unvalidated username is later serialized verbatim into vpnc's configuration as an "Xauth username" directive. A local unprivileged user can create a VPN profile whose username contains a newline character followed by a "Password helper" directive, causing the root-privileged vpnc process to parse the injected directive and execute an attacker-chosen helper program with UID/EUID 0 when the malicious VPN connection is activated.
Affected Software
Event History
Frequently Asked Questions
Is this exploitable remotely?
The described attack requires a local unprivileged user who can create a VPN profile. Exploitation occurs when the malicious VPN connection is activated.
What level of access can an attacker gain?
A successful attack causes vpnc to execute an attacker-chosen helper program with UID/EUID 0. This results in local privilege escalation to root.