The destroy_one_secret function in nm-setting-vpn.c in libnm-util in the NetworkManager package 0.8.999-3.git20110526 in Fedora 15 creates a log entry containing a certificate password, which allows local users to obtain sensitive information by reading a log file.

The remote NewStart CGSL host, running version MAIN 6.06, has NetworkManager packages installed that are affected by multiple vulnerabilities:

  - A buffer overflow vulnerability in the dhcp6 client of systemd allows a malicious dhcp6 server to     overwrite heap memory in systemd-networkd. Affected releases are systemd: versions up to and including     239. (CVE-2018-15688)

  - Incomplete blacklist vulnerability in the svEscape function in settings/plugins/ifcfg-rh/shvar.c in the     ifcfg-rh plug-in for GNOME NetworkManager 0.9.1, 0.9.0, 0.8.1, and possibly other versions, when PolicyKit     is configured to allow users to create new connections, allows local users to execute arbitrary commands     via a newline character in the name for a new network connection, which is not properly handled when     writing to the ifcfg file. (CVE-2011-3364)

  - nm-applet.conf in GNOME NetworkManager before 0.7.0.99 contains an incorrect deny setting, which allows     local users to discover (1) network connection passwords and (2) pre-shared keys via calls to the     GetSecrets method in the dbus request handler. (CVE-2009-0365)

  - GNOME NetworkManager before 0.7.0.99 does not properly verify privileges for dbus (1) modify and (2)     delete requests, which allows local users to change or remove the network connections of arbitrary users     via unspecified vectors related to org.freedesktop.NetworkManagerUserSettings and at_console.
    (CVE-2009-0578)

  - DBus-GLib 0.73 disregards the access flag of exported GObject properties, which allows local users to     bypass intended access restrictions and possibly cause a denial of service by modifying properties, as     demonstrated by properties of the (1) DeviceKit-Power, (2) NetworkManager, and (3) ModemManager services.
    (CVE-2010-1172)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update includes no changes to NetworkManager but ensures that the latest update is installed to fix a security issue in NetworkManager-0.8.999-3.git20110526. This issue was previously fixed in NetworkManager-0.8.9997-1.git20110531.fc15 but was not marked as a security update.

NetworkManager-0.8.999-3.git20110526 inadvertently included a piece of debugging code that may have logged some VPN passwords to syslog. That version was available as an update for five (5) days before the fixed version was available. Users are advised to inspect log files in /var/log (and any backups) for VPN passwords and remove any that are found. The string 'destroy_one_secret' may be used to identify files to be cleaned, such as by using the following command: 'grep -riI 'destroy_one_secret' /var/log'.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
266235	NewStart CGSL MAIN 6.06 : NetworkManager Multiple Vulnerabilities (NS-SA-2025-0213)	Nessus	NewStart CGSL Local Security Checks	high
55061	Fedora 15 : NetworkManager-0.8.9997-2.git20110531.fc15 (2011-7919)	Nessus	Fedora Local Security Checks	low

Detections

Analytics

CVE-2011-1943

medium

Tenable Plugins

high

low