Actu
Vigil@nce: NetworkManager, two vulnerabilities
March 2009 by Vigil@nce
Two vulnerabilities of NetworkManager can be used by a local
attacker to obtain network passwords or to change the network
configuration.
– Gravity: 2/4
– Consequences: user access/rights, data reading, data
creation/edition
– Provenance: user account
– Means of attack: no proof of concept, no attack
– Ability of attacker: expert (4/4)
– Confidence: confirmed by the editor (5/5)
– Diffusion of the vulnerable configuration: high (3/3)
– Number of vulnerabilities in this bulletin: 2
– Creation date: 09/03/2009
IMPACTED PRODUCTS
– Fedora
– Unix - plateform
DESCRIPTION OF THE VULNERABILITY
The NetworkManager program is used to transparently configure a
network. It is impacted by two vulnerabilities.
The nm-applet.conf configuration file blocks the D-BUS access to
org.freedesktop.NetworkManagerSettings.Secrets instead of
org.freedesktop.NetworkManagerSettings.Connection.Secrets. A local
attacker can therefore use a D-BUS query to obtain network
passwords and pre-shared keys of users via GetSecrets. [grav:2/4;
487722, CVE-2009-0365]
A local attacker with an access to org.freedesktop.NetworkManagerUserSetting
can change the network configuration. [grav:2/4; 487752,
CVE-2009-0578]
CHARACTERISTICS
– Identifiers: 487722, 487752, BID-33966, CVE-2009-0365,
CVE-2009-0578, VIGILANCE-VUL-8519
– Url: http://vigilance.fr/vulnerability/NetworkManager-two-vulnerabilities-8519
