GNOME NetworkManager before 0.8.6 does not properly enforce the auth_admin element in PolicyKit, which allows local users to bypass intended wireless network sharing restrictions via unspecified vectors.

NetworkManager did not pin a certificate's subject to an ESSID. A rogue access point could therefore be used to conduct MITM attacks by using any other valid certificate issued by same CA as used in the original network (CVE-2006-7246).

Please note that existing WPA2 Enterprise connections need to be deleted and re-created to take advantage of the new security checks.

NetworkManager did not honor the PolicyKit auth_admin setting when creating Ad-Hoc wireless networks (CVE-2011-2176)

From Red Hat Security Advisory 2011:0930 :

Updated NetworkManager packages that fix one security issue are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

NetworkManager is a network link manager that attempts to keep a wired or wireless network connection active at all times.

It was found that NetworkManager did not properly enforce PolicyKit settings controlling the permissions to configure wireless network sharing. A local, unprivileged user could use this flaw to bypass intended PolicyKit restrictions, allowing them to enable wireless network sharing. (CVE-2011-2176)

Users of NetworkManager should upgrade to these updated packages, which contain a backported patch to correct this issue. Running instances of NetworkManager must be restarted ('service NetworkManager restart') for this update to take effect.

Security issues were identified and fixed in networkmanager :

GNOME NetworkManager before 0.8.6 does not properly enforce the auth_admin element in PolicyKit, which allows local users to bypass intended wireless network sharing restrictions via unspecified vectors (CVE-2011-2176).

Incomplete blacklist vulnerability in the svEscape function in settings/plugins/ifcfg-rh/shvar.c in the ifcfg-rh plug-in for GNOME NetworkManager 0.9.1, 0.9.0, 0.8.1, and possibly other versions, when PolicyKit is configured to allow users to create new connections, allows local users to execute arbitrary commands via a newline character in the name for a new network connection, which is not properly handled when writing to the ifcfg file (CVE-2011-3364).

Instead of patching networkmanager, the latest 0.8.6.0 stable version is being provided due to the large amount of bugs fixed upstream. Also the networkmanager-applet, networkmanager-openconnect, networkmanager-openvpn, networkmanager-pptp, networkmanager-vpnc is being provided with their latest 0.8.6.0 stable versions.

The provided packages solves these security vulnerabilities.

NetworkManager is a network link manager that attempts to keep a wired or wireless network connection active at all times.

It was found that NetworkManager did not properly enforce PolicyKit settings controlling the permissions to configure wireless network sharing. A local, unprivileged user could use this flaw to bypass intended PolicyKit restrictions, allowing them to enable wireless network sharing. (CVE-2011-2176)

Users of NetworkManager should upgrade to these updated packages, which contain a backported patch to correct this issue. Running instances of NetworkManager must be restarted ('service NetworkManager restart') for this update to take effect.

This update fixes the security issue for creating shared WiFi networks. It's been tracked by #709662 - CVE-2011-2176.

Before this update, NetworkManager didn't respect PolicyKit policies for creating shared WiFi networks: actions org.freedesktop.network-manager-settings.system.wifi.share.open and org.freedesktop.network-manager-settings.system.wifi.share.protected in /usr/share/polkit-1/actions/org.freedesktop.network-manager-settings.s ystem.policy file. Thus, users could create shared WiFi networks even if it was disabled via the PolicyKit setting. This update fixes this issue. Be aware, that the default policies still allow creating shared WiFi networks. You should modify <allow_active>yes</allow_active> to <allow_active>auth_admin</allow_active> if you require authorization with root password, or to <allow_active>no</allow_active> to disallow creating the networks altogether through the above PolicyKit actions.

In addition, this update fixes other bugs by updating NetworkManager to git snaphot as of 2011-06-22.

  - core: fix up checks for s390 CTC device type (bgo     #649025)

    - core: recognize platform 'gadget' devices

    - core: only send hostname without domain as host-name       option (rh #694758)

    - core: clear 'invalid' connection tag when cable is       re-plugged

    - core: fix crash requesting system VPN secrets (bgo       #651710)

    - core: add MAC address blacklisting feature for WiFi       and ethernet connections

    - core: allow _ as a valid character for GSM APNs

    - wifi: always fix up Ad-Hoc frequency when connecting       (rh #699203)

    - keyfile: better handle cert/key files that don't exist       (bgo #649807)

    - keyfile: ignore .pem and .der file changes

    - editor: improve usability for entering manual IP       addresses and routes (rh #698199) (bgo #607678)

    - editor: don't crash in edit_done_cb() when connection       is invalid (rh #704848)

    - editor: don't allow inserting 0.0.0.0 as destination       and netmask for IPv4 routes

    - editor: allow _ as a valid character for GSM APNs

    - applet: ensure entries activate default button if       Enter is pressed (rh #622487)

    - applet: add gsm registration status notification

    - applet: filter APN entry characters in mobile-wizard

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2011:0930 advisory.

  - NetworkManager: Did not honour PolicyKit auth_admin action element by creation of Ad-Hoc wireless networks     (CVE-2011-2176)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update ensures that users are authorized to start shared wifi connections, and includes fixes to retry failed connections after a period of time. It also ensures that 'always ask' 802.1x passwords (like RSA Token codes) are asked for again immediately if they fail, and adds the capability to blacklist certain devices from using a wired or wifi connection.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
75976	openSUSE Security Update : NetworkManager (openSUSE-SU-2011:1273-1)	Nessus	SuSE Local Security Checks	low
75683	openSUSE Security Update : NetworkManager (openSUSE-SU-2011:1273-1)	Nessus	SuSE Local Security Checks	low
68306	Oracle Linux 6 : NetworkManager (ELSA-2011-0930)	Nessus	Oracle Linux Local Security Checks	low
61935	Mandriva Linux Security Advisory : networkmanager (MDVSA-2011:171)	Nessus	Mandriva Local Security Checks	medium
61081	Scientific Linux Security Update : NetworkManager on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	low
55842	Fedora 14 : NetworkManager-0.8.4-2.git20110622.fc14 (2011-8612)	Nessus	Fedora Local Security Checks	low
55585	RHEL 6 : NetworkManager (RHSA-2011:0930)	Nessus	Red Hat Local Security Checks	critical
55529	Fedora 15 : NetworkManager-0.8.9997-5.git20110702.fc15 (2011-9005)	Nessus	Fedora Local Security Checks	low

Detections

Analytics

CVE-2011-2176

critical

Tenable Plugins

low

low

low

medium

low

low

critical

low