GNOME NetworkManager before 0.8.6 does not properly enforce the auth_admin element in PolicyKit, which allows local users to bypass intended wireless network sharing restrictions via unspecified vectors.

The remote NewStart CGSL host, running version MAIN 6.06, has NetworkManager packages installed that are affected by multiple vulnerabilities:

  - A buffer overflow vulnerability in the dhcp6 client of systemd allows a malicious dhcp6 server to     overwrite heap memory in systemd-networkd. Affected releases are systemd: versions up to and including     239. (CVE-2018-15688)

  - Incomplete blacklist vulnerability in the svEscape function in settings/plugins/ifcfg-rh/shvar.c in the     ifcfg-rh plug-in for GNOME NetworkManager 0.9.1, 0.9.0, 0.8.1, and possibly other versions, when PolicyKit     is configured to allow users to create new connections, allows local users to execute arbitrary commands     via a newline character in the name for a new network connection, which is not properly handled when     writing to the ifcfg file. (CVE-2011-3364)

  - nm-applet.conf in GNOME NetworkManager before 0.7.0.99 contains an incorrect deny setting, which allows     local users to discover (1) network connection passwords and (2) pre-shared keys via calls to the     GetSecrets method in the dbus request handler. (CVE-2009-0365)

  - GNOME NetworkManager before 0.7.0.99 does not properly verify privileges for dbus (1) modify and (2)     delete requests, which allows local users to change or remove the network connections of arbitrary users     via unspecified vectors related to org.freedesktop.NetworkManagerUserSettings and at_console.
    (CVE-2009-0578)

  - DBus-GLib 0.73 disregards the access flag of exported GObject properties, which allows local users to     bypass intended access restrictions and possibly cause a denial of service by modifying properties, as     demonstrated by properties of the (1) DeviceKit-Power, (2) NetworkManager, and (3) ModemManager services.
    (CVE-2010-1172)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

NetworkManager did not pin a certificate's subject to an ESSID. A rogue access point could therefore be used to conduct MITM attacks by using any other valid certificate issued by same CA as used in the original network (CVE-2006-7246).

Please note that existing WPA2 Enterprise connections need to be deleted and re-created to take advantage of the new security checks.

NetworkManager did not honor the PolicyKit auth_admin setting when creating Ad-Hoc wireless networks (CVE-2011-2176)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2011-0930 advisory.

    [0.8.1-9_el6_1.1]
    - core: CVE-2011-2176: check for authorization when activating shared wifi connections (rh #705806)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security issues were identified and fixed in networkmanager :

GNOME NetworkManager before 0.8.6 does not properly enforce the auth_admin element in PolicyKit, which allows local users to bypass intended wireless network sharing restrictions via unspecified vectors (CVE-2011-2176).

Incomplete blacklist vulnerability in the svEscape function in settings/plugins/ifcfg-rh/shvar.c in the ifcfg-rh plug-in for GNOME NetworkManager 0.9.1, 0.9.0, 0.8.1, and possibly other versions, when PolicyKit is configured to allow users to create new connections, allows local users to execute arbitrary commands via a newline character in the name for a new network connection, which is not properly handled when writing to the ifcfg file (CVE-2011-3364).

Instead of patching networkmanager, the latest 0.8.6.0 stable version is being provided due to the large amount of bugs fixed upstream. Also the networkmanager-applet, networkmanager-openconnect, networkmanager-openvpn, networkmanager-pptp, networkmanager-vpnc is being provided with their latest 0.8.6.0 stable versions.

The provided packages solves these security vulnerabilities.

NetworkManager is a network link manager that attempts to keep a wired or wireless network connection active at all times.

It was found that NetworkManager did not properly enforce PolicyKit settings controlling the permissions to configure wireless network sharing. A local, unprivileged user could use this flaw to bypass intended PolicyKit restrictions, allowing them to enable wireless network sharing. (CVE-2011-2176)

Users of NetworkManager should upgrade to these updated packages, which contain a backported patch to correct this issue. Running instances of NetworkManager must be restarted ('service NetworkManager restart') for this update to take effect.

This update fixes the security issue for creating shared WiFi networks. It's been tracked by #709662 - CVE-2011-2176.

Before this update, NetworkManager didn't respect PolicyKit policies for creating shared WiFi networks: actions org.freedesktop.network-manager-settings.system.wifi.share.open and org.freedesktop.network-manager-settings.system.wifi.share.protected in /usr/share/polkit-1/actions/org.freedesktop.network-manager-settings.s ystem.policy file. Thus, users could create shared WiFi networks even if it was disabled via the PolicyKit setting. This update fixes this issue. Be aware, that the default policies still allow creating shared WiFi networks. You should modify <allow_active>yes</allow_active> to <allow_active>auth_admin</allow_active> if you require authorization with root password, or to <allow_active>no</allow_active> to disallow creating the networks altogether through the above PolicyKit actions.

In addition, this update fixes other bugs by updating NetworkManager to git snaphot as of 2011-06-22.

  - core: fix up checks for s390 CTC device type (bgo     #649025)

    - core: recognize platform 'gadget' devices

    - core: only send hostname without domain as host-name       option (rh #694758)

    - core: clear 'invalid' connection tag when cable is       re-plugged

    - core: fix crash requesting system VPN secrets (bgo       #651710)

    - core: add MAC address blacklisting feature for WiFi       and ethernet connections

    - core: allow _ as a valid character for GSM APNs

    - wifi: always fix up Ad-Hoc frequency when connecting       (rh #699203)

    - keyfile: better handle cert/key files that don't exist       (bgo #649807)

    - keyfile: ignore .pem and .der file changes

    - editor: improve usability for entering manual IP       addresses and routes (rh #698199) (bgo #607678)

    - editor: don't crash in edit_done_cb() when connection       is invalid (rh #704848)

    - editor: don't allow inserting 0.0.0.0 as destination       and netmask for IPv4 routes

    - editor: allow _ as a valid character for GSM APNs

    - applet: ensure entries activate default button if       Enter is pressed (rh #622487)

    - applet: add gsm registration status notification

    - applet: filter APN entry characters in mobile-wizard

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2011:0930 advisory.

  - NetworkManager: Did not honour PolicyKit auth_admin action element by creation of Ad-Hoc wireless networks     (CVE-2011-2176)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update ensures that users are authorized to start shared wifi connections, and includes fixes to retry failed connections after a period of time. It also ensures that 'always ask' 802.1x passwords (like RSA Token codes) are asked for again immediately if they fail, and adds the capability to blacklist certain devices from using a wired or wifi connection.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
266235	NewStart CGSL MAIN 6.06 : NetworkManager Multiple Vulnerabilities (NS-SA-2025-0213)	Nessus	NewStart CGSL Local Security Checks	high
75976	openSUSE Security Update : NetworkManager (openSUSE-SU-2011:1273-1)	Nessus	SuSE Local Security Checks	low
75683	openSUSE Security Update : NetworkManager (openSUSE-SU-2011:1273-1)	Nessus	SuSE Local Security Checks	low
68306	Oracle Linux 6 : NetworkManager (ELSA-2011-0930)	Nessus	Oracle Linux Local Security Checks	critical
61935	Mandriva Linux Security Advisory : networkmanager (MDVSA-2011:171)	Nessus	Mandriva Local Security Checks	medium
61081	Scientific Linux Security Update : NetworkManager on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	low
55842	Fedora 14 : NetworkManager-0.8.4-2.git20110622.fc14 (2011-8612)	Nessus	Fedora Local Security Checks	low
55585	RHEL 6 : NetworkManager (RHSA-2011:0930)	Nessus	Red Hat Local Security Checks	critical
55529	Fedora 15 : NetworkManager-0.8.9997-5.git20110702.fc15 (2011-9005)	Nessus	Fedora Local Security Checks	low

Detections

Analytics

CVE-2011-2176

critical

Tenable Plugins

high

low

low

critical

medium

low

low

critical

low