CVE-2020-14976: 
NixOS vulnerability analysis and mitigation

GNS3 ubridge through version 0.9.18 on macOS, as used in GNS3 server before 2.1.17, contains a local file read vulnerability. The issue allows a local attacker to read arbitrary files because it handles configuration-file errors by printing the configuration file while executing in a setuid root context (NVD, Debian Tracker).

The vulnerability exists in the configuration file error handling mechanism of ubridge. When running with setuid root privileges on macOS systems, the application prints the contents of configuration files during error processing, which can be exploited to read arbitrary files on the system (GNS3 Commit).

The vulnerability allows local attackers to read arbitrary files on the affected system when ubridge is running with elevated privileges. This could potentially lead to exposure of sensitive information or system configuration details (NVD).

The vulnerability requires local access to the system running GNS3 with ubridge. The attacker needs to trigger configuration file errors to exploit the vulnerability while ubridge is running with setuid root privileges (Debian Tracker).

The vulnerability was fixed in GNS3 server version 2.1.17. Users should upgrade to this version or later to mitigate the vulnerability (GNS3 Release).