Ubuntu 'network-manager' Package CVE-2015-1322 Local Directory Traversal Vulnerability

Bugtraq ID:	74409
Class:	Input Validation Error
CVE:	CVE-2015-1322
Remote:	No
Local:	Yes
Published:	Apr 29 2015 12:00AM
Updated:	Apr 29 2015 12:00AM
Credit:	Tavis Ormandy
Vulnerable:	Ubuntu Vivid 0 Ubuntu Ubuntu Linux 14.10 Ubuntu Ubuntu Linux 14.04 LTS Ubuntu network-manager 0
Not Vulnerable:	Ubuntu network-manager 0.9.8.8-0ubuntu7.1 Ubuntu network-manager 0.9.8.8-0ubuntu28.1 Ubuntu network-manager 0.9.10.0-4ubuntu15.1

Ubuntu 'network-manager' Package CVE-2015-1322 Local Directory Traversal Vulnerability

Ubuntu 'network-manager' package is prone to a local directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.

A local attacker could exploit this vulnerability using directory-traversal characters ('../') to access arbitrary files that contain sensitive information and perform other attacks.

Ubuntu 'network-manager' Package CVE-2015-1322 Local Directory Traversal Vulnerability

An attacker can use readily available commands and tools to exploit this issue.

Ubuntu 'network-manager' Package CVE-2015-1322 Local Directory Traversal Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Ubuntu 'network-manager' Package CVE-2015-1322 Local Directory Traversal Vulnerability

References:

• com.canonical.NMOfono.ReadImsiContexts privilege escalation (Ubuntu)
  
• Network Manager Homepage (Ubuntu)
  
• Ubuntu Homepage (Ubuntu)
  
• USN-2581-1: NetworkManager vulnerability (Ubuntu)