CVE-2018-1000135 : GNOME NetworkManager version 1.10.2 and earlier contains a Information Exposure (CWE-200) vulnerability in DNS resolver

GNOME NetworkManager version 1.10.2 and earlier contains a Information Exposure (CWE-200) vulnerability in DNS resolver that can result in Private DNS queries leaked to local network's DNS servers, while on VPN. This vulnerability appears to have been fixed in Some Ubuntu 16.04 packages were fixed, but later updates removed the fix. cf. https://bugs.launchpad.net/ubuntu/+bug/1754671 an upstream fix does not appear to be available at this time.

Published 2018-03-20 13:29:00

Updated 2019-06-03 12:29:01

Source MITRE

View at NVD, CVE.org

Vulnerability category: Information leak

Threat overview for CVE-2018-1000135

Top countries where our scanners detected CVE-2018-1000135

Top open port discovered on systems with this issue 8200

IPs affected by CVE-2018-1000135 22

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2018-1000135!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2018-1000135

Probability of exploitation activity in the next 30 days: 0.31%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 66 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2018-1000135

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
7.5	HIGH	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2018-1000135

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2018-1000135

http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00005.html

[security-announce] openSUSE-SU-2019:1494-1: moderate: Security update f
https://bugs.launchpad.net/ubuntu/+source/network-manager/+bug/1754671

Bug #1754671 “Full-tunnel VPN DNS leakage regression” : Bugs : network-manager package : Ubuntu
Issue Tracking;Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1553634

1553634 – CVE-2018-1000135 Full-tunnel VPN misconfigures DNS servers, leaks private information
Issue Tracking;Third Party Advisory
https://bugzilla.gnome.org/show_bug.cgi?id=746422

Bug 746422 – [CVE-2018-1000135] Unencrypted DNS queries leaked outside full-tunnel VPN
Issue Tracking;Third Party Advisory
http://www.securityfocus.com/bid/103478

GNOME NetworkManager CVE-2018-1000135 Information Disclosure Vulnerability
Third Party Advisory;VDB Entry

Products affected by CVE-2018-1000135