NetworkManager is an universal network configuration daemon for laptops, desktops, servers and virtualization hosts.
The VPNC plugin provides easy access Cisco Concentrator based VPN’s utilizing NetworkManager.
When initiating a VPNC connection, NetworkManager spawns a new vpnc process and passes the configuration via STDIN. By injecting a special character into a configuration parameter, an attacker can coerce NetworkManager to set the Password helper option to an attacker controlled executable file.
A local attacker is able to escalate privileges via a specially crafted configuration file.
There is no known workaround at this time.
All NetworkManager VPNC plugin users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose
">=net-misc/networkmanager-vpnc-1.2.6"