NVD

Id
10019  
Name
CVE-2011-3364  
Description
Incomplete blacklist vulnerability in the svEscape function in settings/plugins/ifcfg-rh/shvar.c in the ifcfg-rh plug-in for GNOME NetworkManager 0.9.1, 0.9.0, 0.8.1, and possibly other versions, when PolicyKit is configured to allow users to create new connections, allows local users to execute arbitrary commands via a newline character in the name for a new network connection, which is not properly handled when writing to the ifcfg file.  
Reject
 
CVSS Version
2  
CVSS Score
6.9  
Severity
Medium  
CVSS Base Score
6.9  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
3.4  
CVSS Vector
(AV:L/AC:M/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-07  
Published
2011-11-04  
Modified Date
2012-01-18  
Seq
2011-3364  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
57452 10019 CVE-2011-3364 FEDORA-2011-13425  View
57453 10019 CVE-2011-3364 MDVSA-2011:171  View
57454 10019 CVE-2011-3364 RHSA-2011:1338  View
57455 10019 CVE-2011-3364 http://xorl.wordpress.com/2011/10/09/cve-2011-3364-gnome-networkmanager-local-privilege-escalation/  View
57456 10019 CVE-2011-3364 https://bugzilla.redhat.com/show_bug.cgi?id=737338  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
32527 JVNDB-2011-002767 GNOME NetworkManager における任意のコマンドを実行される脆弱性 GNOME NetworkManager の ifcfg-rh plug-in 内にある settings/plugins/ifcfg-rh/shvar.c の svEscape は、ユーザに新規接続作成を許可するように PolicyKit が設定されているとき、任意のコマンドを実行される脆弱性が存在します。 CVE-2011-3364 51271 CVE-2011-3364 10019 6.9 http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-002767.html 2011-11-04 2011-11-10 View