PT-2018-3462 · Gnome+2 · Networkmanager-Gnome+2

David Woodhouse · Publicado 2018-02-09 · Atualizado 2024-06-15 · CVE-2018-1000135

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions: GNOME NetworkManager version 1.10.2 and earlier

Description: The issue is related to an information exposure in the DNS resolver of GNOME NetworkManager, which can lead to private DNS queries being leaked to local network's DNS servers while on VPN. This is due to a lack of protection for service data. An attacker could exploit this to gain unauthorized access to information.

Recommendations: For GNOME NetworkManager version 1.10.2 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

ALT-PU-2018-1167

BDU:2020-01815

CVE-2018-1000135

OPENSUSE-SU-2019:1494-1

OPENSUSE-SU-2019_1494-1

OPENSUSE-SU-2024:10602-1

SUSE-SU-2019:1369-1

SUSE-SU-2019_1369-1

Produtos afetados

Alt Linux

Networkmanager-Gnome

Suse

Referências · 36

• https://lists.suse.com/pipermail/sle-security-updates/2019-May/005511.html · Nota
• https://lists.opensuse.org/archives/list/[e-mail]/thread/C5HHHP6HRC27GJXSH33SJTDNWTSVTWFT/#C5HHHP6HRC27GJXSH33SJTDNWTSVTWFT · Nota
• http://securityfocus.com/bid/103478 · Nota
• https://cve.org/CVERecord?id=CVE-2018-1000135 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2018-1000135 · Aviso do Fabricante
• https://osv.dev/vulnerability/openSUSE-SU-2019:1494-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2018-1000135.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000135 · Nota de Segurança
• https://bugs.launchpad.net/ubuntu/+source/network-manager/+bug/1754671 · Nota
• https://suse.com/support/update/announcement/2019/suse-su-20191369-1 · Nota
• https://suse.com/security/cve/CVE-2018-1000135 · Nota
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20200327SE16 · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00005.html · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2020-10754 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000135 · Nota de Segurança