Cloudanix VulnDB

CVE-2015-1322

None

CVSS

—

EPSS

0.5%

Published

Apr 29, 2015

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in Ubuntu's network tool lets people already logged into the computer read private files or change mobile network settings they should not touch.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Data Exposure
Component
Application
Class
Path Traversal
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Directory traversal in the com.canonical.NMOfono.ReadImsiContexts D-Bus method allows local processes to supply filenames containing .. sequences, resulting in reading arbitrary files or writing modem configuration outside intended directories.

Why it matters to the business

Local attackers on affected Ubuntu releases can disclose sensitive files or alter mobile broadband settings, enabling limited information theft or connectivity tampering on multi-user systems.

How an attack unfolds

An attacker with a local shell invokes the vulnerable D-Bus method on the NetworkManager service, embedding path traversal sequences in the filename argument to bypass directory restrictions and either read system files or modify modem contexts.

How to fix it

Upgrade network-manager to version 0.9.10.0-4ubuntu15.1 on Ubuntu vivid, 0.9.8.8-0ubuntu28.1 on Ubuntu 14.10, or 0.9.8.8-0ubuntu7.1 on Ubuntu 14.04 LTS. Restrict untrusted local users from D-Bus access to the NetworkManager service where feasible.

How to confirm the fix worked

Verify installed package version matches or exceeds the listed fixed releases; test the D-Bus method with traversal payloads in a lab environment to confirm rejection of .. sequences.

Typical attack path

  1. Obtain local shell or process execution on the target Ubuntu host
  2. Locate the com.canonical.NMOfono D-Bus interface exposed by network-manager
  3. Issue a ReadImsiContexts call containing a crafted filename with ../ sequences
  4. Read returned file contents or observe configuration changes

How to detect it

Inspect system D-Bus logs and audit trails for invocations of com.canonical.NMOfono.ReadImsiContexts containing dot-dot sequences in filenames; correlate with unusual file access or modem configuration changes.

  • com.canonical.NMOfono.ReadImsiContexts
  • ../
  • ReadImsiContexts

What your security team should do

  • Apply the listed network-manager package updates across all Ubuntu 14.04/14.10/vivid systems
  • Review and tighten local D-Bus policy rules for NetworkManager
  • Scan for any lingering unpatched hosts given the 2015 disclosure date

The record

Directory traversal vulnerability in the Ubuntu network-manager package for Ubuntu (vivid) before 0.9.10.0-4ubuntu15.1, Ubuntu 14.10 before 0.9.8.8-0ubuntu28.1, and Ubuntu 14.04 LTS before 0.9.8.8-0ubuntu7.1 allows local users to change the modem device configuration or read arbitrary files via a .. (dot dot) in the file name in a request to read modem device contexts (com.canonical.NMOfono.ReadImsiContexts).

Affected packages

Ecosystem Package Introduced Fixed
Ubuntu:14.04:LTS network-manager 0 0.9.8.8-0ubuntu7.1

Related vulnerabilities