CVE-2011-3364
Published Nov 4, 2011
Last updated 13 years ago
Overview
- Description
- Incomplete blacklist vulnerability in the svEscape function in settings/plugins/ifcfg-rh/shvar.c in the ifcfg-rh plug-in for GNOME NetworkManager 0.9.1, 0.9.0, 0.8.1, and possibly other versions, when PolicyKit is configured to allow users to create new connections, allows local users to execute arbitrary commands via a newline character in the name for a new network connection, which is not properly handled when writing to the ifcfg file.
- Source
- secalert@redhat.com
- NVD status
- Modified
Social media
- Hype score
- Not currently trending
Risk scores
CVSS 2.0
- Type
- Primary
- Base score
- 6.9
- Impact score
- 10
- Exploitability score
- 3.4
- Vector string
- AV:L/AC:M/Au:N/C:C/I:C/A:C
Weaknesses
- nvd@nist.gov
- NVD-CWE-Other
Evaluator
- Comment
- Per: http://cwe.mitre.org/data/definitions/184.html 'CWE-184: Incomplete Blacklist'
- Impact
- -
- Solution
- -
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:gnome:ifcfg-rh_plug-in:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5CEFC422-92D0-49D4-B10A-019ED2038168"
},
{
"criteria": "cpe:2.3:a:gnome:networkmanager:0.8.1:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "BAC0EE7F-953B-4CF7-8F9F-C5FDE518CEEC"
},
{
"criteria": "cpe:2.3:a:gnome:networkmanager:0.9.0:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "A8A8A8BC-6875-48A0-9E14-8DC01AA2035D"
},
{
"criteria": "cpe:2.3:a:gnome:networkmanager:0.9.1:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "9698C77E-06F2-4E1E-950E-B4FF4EF783E7"
}
],
"operator": "OR"
}
]
}
]