GNOME NetworkManager before 0.7.0.99 does not properly verify privileges for dbus (1) modify and (2) delete requests, which allows local users to change or remove the network connections of arbitrary users via unspecified vectors related to org.freedesktop.NetworkManagerUserSettings and at_console.

The remote NewStart CGSL host, running version MAIN 6.06, has NetworkManager packages installed that are affected by multiple vulnerabilities:

  - A buffer overflow vulnerability in the dhcp6 client of systemd allows a malicious dhcp6 server to     overwrite heap memory in systemd-networkd. Affected releases are systemd: versions up to and including     239. (CVE-2018-15688)

  - Incomplete blacklist vulnerability in the svEscape function in settings/plugins/ifcfg-rh/shvar.c in the     ifcfg-rh plug-in for GNOME NetworkManager 0.9.1, 0.9.0, 0.8.1, and possibly other versions, when PolicyKit     is configured to allow users to create new connections, allows local users to execute arbitrary commands     via a newline character in the name for a new network connection, which is not properly handled when     writing to the ifcfg file. (CVE-2011-3364)

  - nm-applet.conf in GNOME NetworkManager before 0.7.0.99 contains an incorrect deny setting, which allows     local users to discover (1) network connection passwords and (2) pre-shared keys via calls to the     GetSecrets method in the dbus request handler. (CVE-2009-0365)

  - GNOME NetworkManager before 0.7.0.99 does not properly verify privileges for dbus (1) modify and (2)     delete requests, which allows local users to change or remove the network connections of arbitrary users     via unspecified vectors related to org.freedesktop.NetworkManagerUserSettings and at_console.
    (CVE-2009-0578)

  - DBus-GLib 0.73 disregards the access flag of exported GObject properties, which allows local users to     bypass intended access restrictions and possibly cause a denial of service by modifying properties, as     demonstrated by properties of the (1) DeviceKit-Power, (2) NetworkManager, and (3) ModemManager services.
    (CVE-2010-1172)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2009:0362 :

Updated NetworkManager packages that fix a security issue are now available for Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

NetworkManager is a network link manager that attempts to keep a wired or wireless network connection active at all times.

An information disclosure flaw was found in NetworkManager's D-Bus interface. A local attacker could leverage this flaw to discover sensitive information, such as network connection passwords and pre-shared keys. (CVE-2009-0365)

Red Hat would like to thank Ludwig Nussel for responsibly reporting this flaw.

NetworkManager users should upgrade to these updated packages, which contain a backported patch that corrects this issue.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2009-0361 advisory.

    - CVE-2009-0365: GetSecrets disclosure
    - CVE-2009-0578: local users can modify the connection settings

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An information disclosure flaw was found in NetworkManager's D-Bus interface. A local attacker could leverage this flaw to discover sensitive information, such as network connection passwords and pre-shared keys. (CVE-2009-0365)

A potential denial of service flaw was found in NetworkManager's D-Bus interface. A local user could leverage this flaw to modify local connection settings, preventing the system's network connection from functioning properly. (CVE-2009-0578)

Updated NetworkManager packages that fix two security issues are now available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

NetworkManager is a network link manager that attempts to keep a wired or wireless network connection active at all times.

An information disclosure flaw was found in NetworkManager's D-Bus interface. A local attacker could leverage this flaw to discover sensitive information, such as network connection passwords and pre-shared keys. (CVE-2009-0365)

A potential denial of service flaw was found in NetworkManager's D-Bus interface. A local user could leverage this flaw to modify local connection settings, preventing the system's network connection from functioning properly. (CVE-2009-0578)

Red Hat would like to thank Ludwig Nussel for reporting these flaws responsibly.

Users of NetworkManager should upgrade to these updated packages which contain backported patches to correct these issues.

The NetworkManager configuration was too permissive and allowed any user to read secrets (CVE-2009-0365) or manipulate the configuration of other users. (CVE-2009-0578)

The NetworkManager configuration was too permissive and allowed any user to read secrets (CVE-2009-0365) or manipulate the configuration of other users. (CVE-2009-0578)

Additionally a bug where wifi devices didn't work correctly when the machine was booted with killswitch turned on has been fixed. The automatic ethernet connection can now be edited and NetworkManager can now work without ModemManager.

The NetworkManager configuration was too permissive and allowed any user to read secrets (CVE-2009-0365) or manipulate the configuration of other users (CVE-2009-0578).

The NetworkManager configuration was too permissive and allowed any user to read secrets (CVE-2009-0365) or manipulate the configuration of other users (CVE-2009-0578).

With the previous update PPP connections didn't work. This second update fixes that problem.

Additionally a bug where wifi devices didn't work correctly when the machine was booted with killswitch turned on has been fixed. The automatic ethernet connection can now be edited and NetworkManager can now work without ModemManager.

Updated NetworkManager packages that fix a security issue are now available for Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

NetworkManager is a network link manager that attempts to keep a wired or wireless network connection active at all times.

An information disclosure flaw was found in NetworkManager's D-Bus interface. A local attacker could leverage this flaw to discover sensitive information, such as network connection passwords and pre-shared keys. (CVE-2009-0365)

Red Hat would like to thank Ludwig Nussel for responsibly reporting this flaw.

NetworkManager users should upgrade to these updated packages, which contain a backported patch that corrects this issue.

It was discovered that network-manager-applet did not properly enforce permissions when responding to dbus requests. A local user could perform dbus queries to view other users' network connection passwords and pre-shared keys. (CVE-2009-0365)

It was discovered that network-manager-applet did not properly enforce permissions when responding to dbus modify and delete requests. A local user could use dbus to modify or delete other users' network connections. This issue only applied to Ubuntu 8.10. (CVE-2009-0578).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

USN-727-1 fixed vulnerabilities in network-manager-applet. This advisory provides the corresponding updates for NetworkManager.

It was discovered that NetworkManager did not properly enforce permissions when responding to dbus requests. A local user could perform dbus queries to view system and user network connection passwords and pre-shared keys.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Fedora host is missing one or more security updates :

NetworkManager-0.7.0.99-1.fc10 :

  - Wed Mar 4 2009 Dan Williams <dcbw at redhat.com> -     1:0.7.0.99-1

    - nm: make default wired 'Auto ethX' connection       modifiable if an enabled system settings plugin       supports modifying connections (rh #485555)

  - nm: manpage fixes (rh #447233)

    - nm: CVE-2009-0365 - GetSecrets disclosure

    - applet: CVE-2009-0578 - local users can modify the       connection settings

    - applet: fix inability to choose WPA Ad-Hoc networks       from the menu

    - ifcfg-rh: add read-only support for WPA-PSK       connections

    - ifcfg-rh: revert fix for #441453 (honor localhost)       until gdm gets fixed

    - Wed Feb 25 2009 Dan Williams <dcbw at redhat.com> -       1:0.7.0.98-1.git20090225

    - Fix getting secrets for system connections (rh       #486696)

    - More compatible modem autodetection

    - Better handle minimal ifcfg files

    - Mon Feb 23 2009 Fedora Release Engineering <rel-eng at       lists.fedoraproject.org> - 1:0.7.0.97-6.git20090220

    - Rebuilt for       https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild

    - Fri Feb 20 2009 Dan Williams <dcbw at redhat.com> -       1:0.7.0.97-5.git20090220

    - Use IFF_LOWER_UP for carrier detect instead of       IFF_RUNNING

    - Add small delay before probing cdc-acm driven mobile       broadband devices

    - Thu Feb 19 2009 Dan Williams <dcbw at redhat.com> -       1:0.7.0.97-4.git20090219

    - Fix PEAP version selection in the applet (rh #468844)

    - Match hostname behavior to 'network' service when       hostname is localhost (rh #441453)

    - Thu Feb 19 2009 Dan Williams <dcbw at redhat.com> -       1:0.7.0.97-2

    - Fix 'noreplace' for nm-system-settings.conf

    - Wed Feb 18 2009 Dan Williams <dcbw at redhat.com> -       1:0.7.0.97-1

    - Update to 0.7.1rc1

    - nm: support for Huawei E160G mobile broadband devices       (rh #466177)

    - nm: fix misleading routing error message (rh #477916)

    - nm: fix issues with 32-character SSIDs (rh #485312)

    - nm: allow root to activate user connections

    - nm: automatic modem detection with udev-extras

    - nm: massive manpage rewrite

    - applet: fix crash when showing the CA certificate       ignore dialog a second time

    - applet: clear keyring items when deleting a connection

    - applet: fix max signal strength calculation in menu       (rh #475123)

    - applet: fix VPN export (rh #480496)

    - Sat Feb 7 2009 Dan Williams <dcbw at redhat.com> -       1:0.7.0-2.git20090207

    - applet: fix blank VPN connection message bubbles

    - applet: better handling of VPN routing on update

    - applet: silence pointless warning (rh #484136)

    - applet: desensitize devices in the menu until they are       ready (rh #483879)

    - nm: Expose WINS servers in the IP4Config over D-Bus

    - nm: Better handling of GSM Mobile Broadband modem       initialization

    - nm: Handle DHCP Classless Static Routes (RFC 3442)

    - nm: Fix Mobile Broadband and PPPoE to always use       'noauth'

    - nm: Better compatibility with older dual-SSID AP       configurations (rh #445369)

    - nm: Mark nm-system-settings.conf as %config (rh       #465633)

    - nm-tool: Show VPN connection information

    - ifcfg-rh: Silence message about ignoring loopback       config (rh #484060)

    - ifcfg-rh: Fix issue with wrong gateway for system       connections (rh #476089)

    - Fri Jan 2 2009 Dan Williams <dcbw at redhat.com> -       1:0.7.0-1.git20090102

[plus 32 lines in the Changelog]

knetworkmanager-0.7-0.8.20080926svn.fc10 :

  - Tue Mar 3 2009 Dan Williams <dcbw at redhat.com> -     0.7-0.8.20080926svn

    - don't send blank passwords in settings (rh #486877)

NetworkManager-vpnc-0.7.0.99-1.fc10 :

  - Thu Mar 5 2009 Dan Williams <dcbw at redhat.com>     1:0.7.0.99-1

    - Update to 0.7.1rc3

    - Mon Feb 23 2009 Fedora Release Engineering <rel-eng at       lists.fedoraproject.org> - 1:0.7.0.97-2

    - Rebuilt for       https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild

    - Thu Feb 19 2009 Dan Williams <dcbw at redhat.com>       1:0.7.0.97-1

    - Update to 0.7.1rc1

    - Handle import/export of 'EnableNat', 'DHGroup',       'SaveUserPassword', and 'EnableLocalLAN'

    - Sat Jan 3 2009 Dan Williams <dcbw at redhat.com>       1:0.7.0-1

    - Rebuild for updated NetworkManager

    - Better handling of passwords that shouldn't be saved

    - Fix some specfile issues (rh #477151)

    - Fri Nov 21 2008 Dan Williams <dcbw at redhat.com>       1:0.7.0-0.11.svn4326

    - Rebuild for updated NetworkManager

    - Tue Nov 18 2008 Dan Williams <dcbw at redhat.com>       1:0.7.0-0.11.svn4296

    - Rebuild for updated NetworkManager

    - Mon Nov 17 2008 Dan Williams <dcbw at redhat.com>       1:0.7.0-0.11.svn4293

    - Ensure errors are shown when connection fails (rh       #331141)

    - Fix failures to ask for passwords on connect (rh       #429287)

    - Fix routing when concentrator specifies routes (rh       #449283)

    - Pull in upstream support for tokens and not saving       passwords

NetworkManager-openconnect-0.7.0.99-1.fc10 :

  - Bug #487722 - CVE-2009-0365 NetworkManager: GetSecrets     disclosure

  - Bug #487752 - CVE-2009-0578 NetworkManager: local users     can modify the connection settings

NetworkManager-openvpn-0.7.0.99-1.fc10 :

  - Thu Mar 5 2009 Dan Williams <dcbw at redhat.com>     1:0.7.0.99-1

    - Update to 0.7.1rc3

    - Mon Feb 23 2009 Fedora Release Engineering <rel-eng at       lists.fedoraproject.org> - 1:0.7.0.97-2

    - Rebuilt for       https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild

    - Thu Feb 19 2009 Dan Williams <dcbw at redhat.com>       1:0.7.0.97-1

    - Update to 0.7.1rc1

    - Handle HMAC Authentication (--auth)

    - Handle TAP device subnet masks correctly

    - Don't segfault if the connection type is invalid

    - Sat Jan 3 2009 Dan Williams <dcbw at redhat.com>       1:0.7.0-18.svn11

    - Rebuild for updated NetworkManager

    - Fix some specfile issues (rh #477149)

    - Sat Dec 20 2008 Christoph Hoger <choeger at       cs.tu-berlin.de> 0.7.0-17.svn4326

    - removed libpng-devel from BuildRequires, added       /usr/share/gnome-vpn-properties/openvpn/ (rh #477149)

    - Fri Nov 21 2008 Dan Williams <dcbw at redhat.com>       1:0.7.0-16.svn4326

    - Rebuild for updated NetworkManager

NetworkManager-pptp-0.7.0.99-1.fc10 :

  - Thu Mar 5 2009 Dan Williams <dcbw at redhat.com>     1:0.7.0.99-1

    - Update to 0.7.1rc3

    - Mon Feb 23 2009 Fedora Release Engineering <rel-eng at       lists.fedoraproject.org> - 1:0.7.0.97-2

    - Rebuilt for       https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild

    - Thu Feb 19 2009 Dan Williams <dcbw at redhat.com>       1:0.7.0.97-1

    - Update to 0.7.1rc1

    - Set a reasonable MTU

    - Ensure 'noauth' is used

    - Fix domain-based logins

    - Fix saving MPPE values in connection editor

    - Sat Jan 3 2009 Dan Williams <dcbw at redhat.com>       1:0.7.0-1.svn16

    - Rebuild for updated NetworkManager

    - Fix some specfile issues (rh #477153)

    - Allow the EAP authentication method

    - Fri Nov 21 2008 Dan Williams <dcbw at redhat.com>       1:0.7.0-12.svn4326

    - Rebuild for updated NetworkManager

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2009:0361 advisory.

    NetworkManager is a network link manager that attempts to keep a wired or     wireless network connection active at all times.

    An information disclosure flaw was found in NetworkManager's D-Bus     interface. A local attacker could leverage this flaw to discover sensitive     information, such as network connection passwords and pre-shared keys.
    (CVE-2009-0365)

    A potential denial of service flaw was found in NetworkManager's D-Bus     interface. A local user could leverage this flaw to modify local connection     settings, preventing the system's network connection from functioning     properly. (CVE-2009-0578)

    Red Hat would like to thank Ludwig Nussel for reporting these flaws     responsibly.

    Users of NetworkManager should upgrade to these updated packages which     contain backported patches to correct these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora host is missing one or more security updates :

NetworkManager-0.7.0.99-1.fc9 :

  - Wed Mar 4 2009 Dan Williams <dcbw at redhat.com> -     1:0.7.0.99-1

    - nm: make default wired 'Auto ethX' connection       modifiable if an enabled system settings plugin       supports modifying connections (rh #485555)

  - nm: manpage fixes (rh #447233)

    - nm: CVE-2009-0365 - GetSecrets disclosure

    - applet: CVE-2009-0578 - local users can modify the       connection settings

    - applet: fix inability to choose WPA Ad-Hoc networks       from the menu

    - ifcfg-rh: add read-only support for WPA-PSK       connections

    - ifcfg-rh: revert fix for #441453 (honor localhost)       until gdm gets fixed

    - Wed Feb 25 2009 Dan Williams <dcbw at redhat.com> -       1:0.7.0.98-1.git20090225

    - Fix getting secrets for system connections (rh       #486696)

    - More compatible modem autodetection

    - Better handle minimal ifcfg files

    - Mon Feb 23 2009 Fedora Release Engineering <rel-eng at       lists.fedoraproject.org> - 1:0.7.0.97-6.git20090220

    - Rebuilt for       https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild

    - Fri Feb 20 2009 Dan Williams <dcbw at redhat.com> -       1:0.7.0.97-5.git20090220

    - Use IFF_LOWER_UP for carrier detect instead of       IFF_RUNNING

    - Add small delay before probing cdc-acm driven mobile       broadband devices

    - Thu Feb 19 2009 Dan Williams <dcbw at redhat.com> -       1:0.7.0.97-4.git20090219

    - Fix PEAP version selection in the applet (rh #468844)

    - Match hostname behavior to 'network' service when       hostname is localhost (rh #441453)

    - Thu Feb 19 2009 Dan Williams <dcbw at redhat.com> -       1:0.7.0.97-2

    - Fix 'noreplace' for nm-system-settings.conf

    - Wed Feb 18 2009 Dan Williams <dcbw at redhat.com> -       1:0.7.0.97-1

    - Update to 0.7.1rc1

    - nm: support for Huawei E160G mobile broadband devices       (rh #466177)

    - nm: fix misleading routing error message (rh #477916)

    - nm: fix issues with 32-character SSIDs (rh #485312)

    - nm: allow root to activate user connections

    - nm: automatic modem detection with udev-extras

    - nm: massive manpage rewrite

    - applet: fix crash when showing the CA certificate       ignore dialog a second time

    - applet: clear keyring items when deleting a connection

    - applet: fix max signal strength calculation in menu       (rh #475123)

    - applet: fix VPN export (rh #480496)

    - Sat Feb 7 2009 Dan Williams <dcbw at redhat.com> -       1:0.7.0-2.git20090207

    - applet: fix blank VPN connection message bubbles

    - applet: better handling of VPN routing on update

    - applet: silence pointless warning (rh #484136)

    - applet: desensitize devices in the menu until they are       ready (rh #483879)

    - nm: Expose WINS servers in the IP4Config over D-Bus

    - nm: Better handling of GSM Mobile Broadband modem       initialization

    - nm: Handle DHCP Classless Static Routes (RFC 3442)

    - nm: Fix Mobile Broadband and PPPoE to always use       'noauth'

    - nm: Better compatibility with older dual-SSID AP       configurations (rh #445369)

    - nm: Mark nm-system-settings.conf as %config (rh       #465633)

    - nm-tool: Show VPN connection information

    - ifcfg-rh: Silence message about ignoring loopback       config (rh #484060)

    - ifcfg-rh: Fix issue with wrong gateway for system       connections (rh #476089)

    - Fri Jan 2 2009 Dan Williams <dcbw at redhat.com> -       1:0.7.0-1.git20090102

[plus 131 lines in the Changelog]

NetworkManager-openconnect-0.7.0.99-1.fc9 :

  - Bug #487722 - CVE-2009-0365 NetworkManager: GetSecrets     disclosure

  - Bug #487752 - CVE-2009-0578 NetworkManager: local users     can modify the connection settings

NetworkManager-pptp-0.7.0.99-1.fc9 :

  - Thu Mar 5 2009 Dan Williams <dcbw at redhat.com>     1:0.7.0.99-1

    - Update to 0.7.1rc3

    - Mon Feb 23 2009 Fedora Release Engineering <rel-eng at       lists.fedoraproject.org> - 1:0.7.0.97-2

    - Rebuilt for       https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild

    - Thu Feb 19 2009 Dan Williams <dcbw at redhat.com>       1:0.7.0.97-1

    - Update to 0.7.1rc1

    - Set a reasonable MTU

    - Ensure 'noauth' is used

    - Fix domain-based logins

    - Fix saving MPPE values in connection editor

    - Sat Jan 3 2009 Dan Williams <dcbw at redhat.com>       1:0.7.0-1.svn16

    - Rebuild for updated NetworkManager

    - Fix some specfile issues (rh #477153)

    - Allow the EAP authentication method

NetworkManager-openvpn-0.7.0.99-1.fc9 :

  - Thu Mar 5 2009 Dan Williams <dcbw at redhat.com>     1:0.7.0.99-1

    - Update to 0.7.1rc3

    - Mon Feb 23 2009 Fedora Release Engineering <rel-eng at       lists.fedoraproject.org> - 1:0.7.0.97-2

    - Rebuilt for       https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild

    - Thu Feb 19 2009 Dan Williams <dcbw at redhat.com>       1:0.7.0.97-1

    - Update to 0.7.1rc1

    - Handle HMAC Authentication (--auth)

    - Handle TAP device subnet masks correctly

    - Don't segfault if the connection type is invalid

    - Sat Jan 3 2009 Dan Williams <dcbw at redhat.com>       1:0.7.0-18.svn11

    - Rebuild for updated NetworkManager

    - Fix some specfile issues (rh #477149)

    - Sat Dec 20 2008 Christoph Hoger <choeger at       cs.tu-berlin.de> 0.7.0-17.svn4326

    - removed libpng-devel from BuildRequires, added       /usr/share/gnome-vpn-properties/openvpn/ (rh #477149)

    - Fri Nov 21 2008 Dan Williams <dcbw at redhat.com>       1:0.7.0-16.svn4326

    - Rebuild for updated NetworkManager

    - Mon Oct 27 2008 Dan Williams <dcbw at redhat.com>       1:0.7.0-16.svn4229

    - Rebuild for updated NetworkManager

    - Sun Oct 12 2008 Dan Williams <dcbw at redhat.com>       1:0.7.0-16.svn4175

    - Rebuild for updated NetworkManager

    - Allow changing passwords from the connection editor

    - Honor OpenVPN's 'route-vpn-gateway' option

    - Tue Sep 30 2008 Dan Williams <dcbw at redhat.com>       1:0.7.0-16.svn4027

    - Fix order of Password TLS certificate choosers (rh       #464765)

    - Use /usr/lib/rpm/find-lang.sh       /var/tmp/NetworkManager-openvpn-0.7.0.99-root for       locale-specific files (rh #448551)

    - Fix --script-security issues with OpenVPN 2.1-rc9 and       later (rh #460754)

    - Fri Aug 29 2008 Dan Williams <dcbw at redhat.com>       1:0.7.0-15.svn4027

    - Rebuild for updated NetworkManager

    - Mon Aug 11 2008 Dan Williams <dcbw at redhat.com>       1:0.7.0-15.svn3930

    - Rebuild for updated NetworkManager

    - Thu Jul 24 2008 Dan Williams <dcbw at redhat.com>       1:0.7.0-15.svn3846

    - Rebuild to sync with F9 release number

    - Thu Jul 24 2008 Dan Williams <dcbw at redhat.com>       1:0.7.0-11.svn3846

    - Fix TLS Authentication direction combo

    - Only update settings if the advanced dialog's OK       button is pressed

    - Fri Jul 18 2008 Dan Williams <dcbw at redhat.com>       1:0.7.0-11.svn3832

    - Update for NM netmask -> prefix changes

    - Wed Jul 2 2008 Dan Williams <dcbw at redhat.com>       1:0.7.0-11.svn3801

    - Update for moving VPN editing into connection manager

    - Import OpenVPN configuration files rather than old       custom format

    - Tue Jun 24 2008 Christoph Hoger <choeger at       cs.tu-berlin.de> 1:0.7.0-14.svn3632

    - revoke last change

    - openvpn seems to be buggy itself

    - Fri Jun 13 2008 Christoph Hoger <choeger at       cs.tu-berlin.de> 1:0.7.0-13.svn3632

    - Fix getting remote ip

    - fixes #446335

NetworkManager-vpnc-0.7.0.99-1.fc9 :

  - Thu Mar 5 2009 Dan Williams <dcbw at redhat.com>     1:0.7.0.99-1

    - Update to 0.7.1rc3

    - Mon Feb 23 2009 Fedora Release Engineering <rel-eng at       lists.fedoraproject.org> - 1:0.7.0.97-2

    - Rebuilt for       https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild

    - Thu Feb 19 2009 Dan Williams <dcbw at redhat.com>       1:0.7.0.97-1

    - Update to 0.7.1rc1

    - Handle import/export of 'EnableNat', 'DHGroup',       'SaveUserPassword', and 'EnableLocalLAN'

    - Sat Jan 3 2009 Dan Williams <dcbw at redhat.com>       1:0.7.0-1

    - Rebuild for updated NetworkManager

    - Better handling of passwords that shouldn't be saved

    - Fix some specfile issues (rh #477151)

    - Fri Nov 21 2008 Dan Williams <dcbw at redhat.com>       1:0.7.0-0.11.svn4326

    - Rebuild for updated NetworkManager

    - Tue Nov 18 2008 Dan Williams <dcbw at redhat.com>       1:0.7.0-0.11.svn4296

    - Rebuild for updated NetworkManager

    - Mon Nov 17 2008 Dan Williams <dcbw at redhat.com>       1:0.7.0-0.11.svn4293

    - Ensure errors are shown when connection fails (rh       #331141)

    - Fix failures to ask for passwords on connect (rh       #429287)

    - Fix routing when concentrator specifies routes (rh       #449283)

    - Pull in upstream support for tokens and not saving       passwords

    - Mon Oct 27 2008 Dan Williams <dcbw at redhat.com>       1:0.7.0-0.11.svn4229

    - Rebuild for updated NetworkManager

    - Tue Oct 14 2008 Dan Williams <dcbw at redhat.com>       1:0.7.0-11.svn4175

    - Fix password issue with configurations that don't save       the user password in the keyring (rh #466864)

  - Sun Oct 12 2008 Dan Williams <dcbw at redhat.com>     1:0.7.0-10.svn4175

    - Rebuild for updated NetworkManager

    - Allow changing passwords from the connection editor

    - Fri Aug 29 2008 Dan Williams <dcbw at redhat.com>       1:0.7.0-10.svn4024

    - Fix regression where username radio buttons were       mistakenly shown in the auth dialog

  - Fix regression where the auth dialog would segfault when     cancel was clicked

    - Wed Aug 27 2008 Dan Williams <dcbw at redhat.com>       1:0.7.0-10.svn4022

    - Rebuild for updated NetworkManager

    - Mon Aug 11 2008 Dan Williams <dcbw at redhat.com>       1:0.7.0-10.svn3928

    - Rebuild for updated NetworkManager

    - Thu Jul 24 2008 Dan Williams <dcbw at redhat.com>       1:0.7.0-10.svn3846

    - Rebuild for updated NetworkManager

    - Fri Jul 18 2008 Dan Williams <dcbw at redhat.com>       1:0.7.0-10.svn3832

    - Update for NM netmask -> prefix changes

    - Wed Jul 2 2008 Dan Williams <dcbw at redhat.com>       1:0.7.0-10.svn3801

    - Update for moving VPN editing into connection manager

    - Add option to disable Dead Peer Detection

    - Add option to select NAT Traversal mode

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
266235	NewStart CGSL MAIN 6.06 : NetworkManager Multiple Vulnerabilities (NS-SA-2025-0213)	Nessus	NewStart CGSL Local Security Checks	high
67829	Oracle Linux 4 : NetworkManager (ELSA-2009-0362)	Nessus	Oracle Linux Local Security Checks	medium
67828	Oracle Linux 5 : NetworkManager (ELSA-2009-0361)	Nessus	Oracle Linux Local Security Checks	medium
60554	Scientific Linux Security Update : NetworkManager on SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
43734	CentOS 5 : NetworkManager (CESA-2009:0361)	Nessus	CentOS Local Security Checks	medium
41470	SuSE 10 Security Update : NetworkManager-gnome (ZYPP Patch Number 6028)	Nessus	SuSE Local Security Checks	medium
41469	SuSE 10 Security Update : NetworkManager (ZYPP Patch Number 6027)	Nessus	SuSE Local Security Checks	medium
41359	SuSE 11 Security Update : NetworkManager (SAT Patch Number 734)	Nessus	SuSE Local Security Checks	medium
40178	openSUSE Security Update : NetworkManager-gnome (NetworkManager-gnome-563)	Nessus	SuSE Local Security Checks	medium
40177	openSUSE Security Update : NetworkManager (NetworkManager-757)	Nessus	SuSE Local Security Checks	medium
40167	openSUSE Security Update : ModemManager (ModemManager-564)	Nessus	SuSE Local Security Checks	medium
39897	openSUSE Security Update : NetworkManager-gnome (NetworkManager-gnome-563)	Nessus	SuSE Local Security Checks	medium
39881	openSUSE Security Update : ModemManager (ModemManager-564)	Nessus	SuSE Local Security Checks	medium
38895	CentOS 4 : NetworkManager (CESA-2009:0362)	Nessus	CentOS Local Security Checks	medium
38131	Ubuntu 7.10 / 8.04 LTS / 8.10 : network-manager-applet vulnerabilities (USN-727-1)	Nessus	Ubuntu Local Security Checks	medium
37740	Ubuntu 6.06 LTS / 8.10 : network-manager vulnerability (USN-727-2)	Nessus	Ubuntu Local Security Checks	medium
36291	Fedora 10 : NetworkManager-openconnect-0.7.0.99-1.fc10 / knetworkmanager-0.7-0.8.20080926svn.fc10 / etc (2009-2419)	Nessus	Fedora Local Security Checks	medium
36030	RHEL 5 : NetworkManager (RHSA-2009:0361)	Nessus	Red Hat Local Security Checks	high
35949	openSUSE 10 Security Update : NetworkManager-gnome (NetworkManager-gnome-6029)	Nessus	SuSE Local Security Checks	medium
35948	openSUSE 10 Security Update : ModemManager (ModemManager-6030)	Nessus	SuSE Local Security Checks	medium
35801	Fedora 9 : NetworkManager-openconnect-0.7.0.99-1.fc9 / NetworkManager-0.7.0.99-1.fc9 / etc (2009-2420)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2009-0578

high

Tenable Plugins

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

high

medium

medium

medium