network-manager-vpnc: CVE-2018-10900: privilege escalation

Debian Bug report logs - #904255
network-manager-vpnc: CVE-2018-10900: privilege escalation

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: network-manager-vpnc: CVE-2018-10900: privilege escalation

Date: Sun, 22 Jul 2018 12:53:20 +0200

Source: network-manager-vpnc
Version: 1.2.4-1
Severity: grave
Tags: patch security upstream

Hi,

The following vulnerability was published for network-manager-vpnc.

CVE-2018-10900[0]:
local privilege escalation

A user with enough privileges to create the vpnc connection entry
(group netdev for instance), can use the flaw in network-manager-vpnc
to escalate privileges.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2018-10900
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10900
[1] https://pulsesecurity.co.nz/advisories/NM-VPNC-Privesc

Update for stretch is already in preparation.

Regards,
Salvatore

Message #10 received at 904255@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: 904255@bugs.debian.org

Subject: network-manager-vpnc: diff for NMU version 1.2.4-7.1

Date: Sun, 22 Jul 2018 13:54:47 +0200

[Message part 1 (text/plain, inline)]

Control: tags 904255 + patch


Dear maintainer,

I've prepared an NMU for network-manager-vpnc (versioned as
1.2.4-7.1). It is not yet uploaded (to any delayed queue, if you want
to do the upload yourself).

Regards,
Salvatore

[network-manager-vpnc-1.2.4-7.1-nmu.diff (text/x-diff, attachment)]

Message #17 received at 904255@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: 904255@bugs.debian.org

Subject: Re: Bug#904255: network-manager-vpnc: diff for NMU version 1.2.4-7.1

Date: Sun, 22 Jul 2018 14:21:20 +0200

[Message part 1 (text/plain, inline)]

On Sun, Jul 22, 2018 at 01:54:47PM +0200, Salvatore Bonaccorso wrote:
> Control: tags 904255 + patch
> 
> 
> Dear maintainer,
> 
> I've prepared an NMU for network-manager-vpnc (versioned as
> 1.2.4-7.1). It is not yet uploaded (to any delayed queue, if you want
> to do the upload yourself).

And actually, if cherry-picking the patch it might be advisable to
revert in the patch the "Use Unicode in translatable strings" change.

Regards,
Salvatore

[service-disallow-newlinies-in-configuration-values-C.patch (text/x-diff, attachment)]

Message #22 received at 904255-close@bugs.debian.org (full text, mbox, reply):

From: Michael Biebl <biebl@debian.org>

To: 904255-close@bugs.debian.org

Subject: Bug#904255: fixed in network-manager-vpnc 1.2.6-1

Date: Tue, 24 Jul 2018 17:19:57 +0000

Source: network-manager-vpnc
Source-Version: 1.2.6-1

We believe that the bug you reported is fixed in the latest version of
network-manager-vpnc, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 904255@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Michael Biebl <biebl@debian.org> (supplier of updated network-manager-vpnc package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Tue, 24 Jul 2018 18:54:43 +0200
Source: network-manager-vpnc
Binary: network-manager-vpnc network-manager-vpnc-gnome
Architecture: source
Version: 1.2.6-1
Distribution: unstable
Urgency: medium
Maintainer: Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debian.org>
Changed-By: Michael Biebl <biebl@debian.org>
Description:
 network-manager-vpnc - network management framework (VPNC plugin core)
 network-manager-vpnc-gnome - network management framework (VPNC plugin GNOME GUI)
Closes: 904255
Changes:
 network-manager-vpnc (1.2.6-1) unstable; urgency=medium
 .
   * New upstream version 1.2.6
     - service: disallow newlines in configuration values (CVE-2018-10900)
       (Closes: #904255)
   * Bump Standards-Version to 4.1.5
   * Drop no-longer needed Breaks/Replaces
Checksums-Sha1:
 918180e0b86ba74be7955113732c9d15fd473258 2282 network-manager-vpnc_1.2.6-1.dsc
 9171ce12542994b1397fbecbccdedc2411ed33ff 417412 network-manager-vpnc_1.2.6.orig.tar.xz
 b7651691849eb3f583bc8f63971db3746fe6a94e 6240 network-manager-vpnc_1.2.6-1.debian.tar.xz
 730d8d9c7954357a4b8e3709ddf3af812e30bf98 6975 network-manager-vpnc_1.2.6-1_source.buildinfo
Checksums-Sha256:
 f6030ea86dc797a56011b901aaa51e51e2d4473ce0dd037a63b35d32f28c5d5d 2282 network-manager-vpnc_1.2.6-1.dsc
 de4fd059c4c08365a40b32b6f6fad9674f556724b4bbeb1f9d4473ac19a745cb 417412 network-manager-vpnc_1.2.6.orig.tar.xz
 570f7140e191397a56f6bf99100e47853cc0cab104cd6680e6b6dcfb5b07d019 6240 network-manager-vpnc_1.2.6-1.debian.tar.xz
 b45a0a454602a5d603b27639325255f5ae24074ab5695bbd63b8eb9c3f8495be 6975 network-manager-vpnc_1.2.6-1_source.buildinfo
Files:
 48c761761c687f61909a653d4e043e8f 2282 net optional network-manager-vpnc_1.2.6-1.dsc
 4e88a3bde38e3921c2adb9983fb9d09f 417412 net optional network-manager-vpnc_1.2.6.orig.tar.xz
 9c61ef0520538ef742633c8da3f3818d 6240 net optional network-manager-vpnc_1.2.6-1.debian.tar.xz
 7594b21de79fb7b077269e708f01e70c 6975 net optional network-manager-vpnc_1.2.6-1_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEECbOsLssWnJBDRcxUauHfDWCPItwFAltXWpYACgkQauHfDWCP
ItwS8w/9FODrDI8skLbAVZPDuppAwIjm1MZn1VK8yW64+N/8H7BF84J2slAz4nra
9FqQFkbb2kbxAEWLiJnm0KSXwMM9SLdbXOPBicrMA9qZHRM3CsfbJBaqHlt8c+lJ
xdWjuG4hZAF3OnrchuJOOzhDdkOa5Nuv8EoRDHmTVfCfdnx5Kvl4tQCfGcLLqvCd
oBb2ubD5WZVQ7q8Z79xba5pmbsDOLMvm+UfIfJ43j7vqSlbBgjXaEQlCll4aCivo
M8ytM94tis+OoX6AQ8VxfueSJ3J/F9CckOIqQFAgfo6H867M7VchJb/ZbcvG9BIp
ZFSssgj4RKW9rCMi4nBNP44J9QcxCdLnK6t6mfl0lRxiLsfdOmSd1VlPkh5jA+Cp
/gkrJKGdyJXHDumRhecXWqNcsSEGozaXc4e6s8fp2z/SSNmpDE8zMjo5x4SzK57n
1ORLVWgmTAkuBeyjvxcQ5OsjBtXmz3n9ekMfILN60bRPr42ajdNARGFeSkEstRgW
11iLoQ9fZmhAnFS6ODI8qZszoqLTFJvySqRwyVu35/cu7q2g/VSDUkCe/MlD50gJ
02UnLrSgXyMhjrr/qk+zAPu4NT6cVSw/tuqe7NysGLI2xx1InSi5OQhTohdCTLO1
DvkiNpCi4yW0ShNJLbnt1MSGgRXCILItIpAviTetr/fAuKxNZdw=
=whjw
-----END PGP SIGNATURE-----

Message #27 received at 904255-close@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: 904255-close@bugs.debian.org

Subject: Bug#904255: fixed in network-manager-vpnc 1.2.4-4+deb9u1

Date: Thu, 26 Jul 2018 21:17:09 +0000

Source: network-manager-vpnc
Source-Version: 1.2.4-4+deb9u1

We believe that the bug you reported is fixed in the latest version of
network-manager-vpnc, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 904255@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Salvatore Bonaccorso <carnil@debian.org> (supplier of updated network-manager-vpnc package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sun, 22 Jul 2018 14:23:44 +0200
Source: network-manager-vpnc
Binary: network-manager-vpnc network-manager-vpnc-gnome
Architecture: source
Version: 1.2.4-4+deb9u1
Distribution: stretch-security
Urgency: high
Maintainer: Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debian.org>
Changed-By: Salvatore Bonaccorso <carnil@debian.org>
Closes: 904255
Description: 
 network-manager-vpnc - network management framework (VPNC plugin core)
 network-manager-vpnc-gnome - network management framework (VPNC plugin GNOME GUI)
Changes:
 network-manager-vpnc (1.2.4-4+deb9u1) stretch-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * service: disallow newlinies in configuration values (CVE-2018-10900)
     (Closes: #904255)
Checksums-Sha1: 
 30529f0f4f6c34da0fd90eb12d48122f279c5547 2620 network-manager-vpnc_1.2.4-4+deb9u1.dsc
 fca590f78467ce120afb02536d944ecde6a62d2e 402428 network-manager-vpnc_1.2.4.orig.tar.xz
 841670ce8489d7633a4e1d614f8d9576a2947422 6860 network-manager-vpnc_1.2.4-4+deb9u1.debian.tar.xz
Checksums-Sha256: 
 3d29ca9a4fd23e095e1a32072bd5727bfec421c92e92e426be0912c169555cbb 2620 network-manager-vpnc_1.2.4-4+deb9u1.dsc
 39c7516418e90208cb534c19628ce40fd50eba0a08b2ebaef8da85720b10fb05 402428 network-manager-vpnc_1.2.4.orig.tar.xz
 5997fe35142380ce76f38a7ec33c850d0173f82444d8252157093e801249d57b 6860 network-manager-vpnc_1.2.4-4+deb9u1.debian.tar.xz
Files: 
 c03f7a2b800f42b1c0245d1524361f3c 2620 net optional network-manager-vpnc_1.2.4-4+deb9u1.dsc
 b482a231f25d3857fd320d7c0b25c785 402428 net optional network-manager-vpnc_1.2.4.orig.tar.xz
 f70c6ecb92cb950c65f3cdb4b79601cd 6860 net optional network-manager-vpnc_1.2.4-4+deb9u1.debian.tar.xz

-----BEGIN PGP SIGNATURE-----

iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAltUelNfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk
ZWJpYW4ub3JnAAoJEAVMuPMTQ89EYSkP/3v/dCBfdTev2sVmGo8HY0geOJ5L0MbE
aKxxgIR7o+VwjmfQaVYilTJcbhNvdIh4MSBjgbRc7FNLntLEhov0O0k1+p/V4j4s
TV9y5i/jjKloQtC5mSnifD+xIc6ZGDptWFNzVmg54M7Jf8nmITwg8YVl/CxxMdvL
9ytg5vvmgRSfCVbo1DNkEW+bUDu2Moz0ljQmgCVhbPnTGtmNsTxdlNiLxcaXWd3O
zXhn/FpMj7K/Kw5uYcd96sr/NGvJKHu1NhcOyo7iUI4DtWZCweXGUce5tMZyU359
j9eImJelNUqjAQrnTBZXZDH1wrYNQ34VmP1xJIogCWIdKl3RoClXCnpqVeXdSayI
w2HSP9fv2KMSauqmDzUvFrPbNNiSrkdZgJaKBqTt6JO2ndpVL24W+3KwUM1AoboS
0gxB25m9O5j37EdDQmx+1rzsQUKsOwKAThAdnTlD3Nu5e12WhW0Pkx0EzYlTTUNZ
aUwPqSylGbTJU5RNycVTgUOHrRCO2ZBWwud0CZrfbvcqS87AvFujSf6n+ZPais4R
aFt96wKBJYxAabltDwE1un+dVysaQBSeLE3tJB9J4TLmmQzi+bIrbq6vF35g6A20
rHUvQ09Cvx6/JkYRK4zY4lwsF6CvqWXVvqb7YeRq27ULmKNnnGgr0qPCRhIyTmxF
e0akPRr3YjPa
=v0f9
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.