Incomplete blacklist vulnerability in the svEscape function in settings/plugins/ifcfg-rh/shvar.c in the ifcfg-rh plug-in for GNOME NetworkManager 0.9.1, 0.9.0, 0.8.1, and possibly other versions, when PolicyKit is configured to allow users to create new connections, allows local users to execute arbitrary commands via a newline character in the name for a new network connection, which is not properly handled when writing to the ifcfg file.

The remote NewStart CGSL host, running version MAIN 6.06, has NetworkManager packages installed that are affected by multiple vulnerabilities:

  - A buffer overflow vulnerability in the dhcp6 client of systemd allows a malicious dhcp6 server to     overwrite heap memory in systemd-networkd. Affected releases are systemd: versions up to and including     239. (CVE-2018-15688)

  - Incomplete blacklist vulnerability in the svEscape function in settings/plugins/ifcfg-rh/shvar.c in the     ifcfg-rh plug-in for GNOME NetworkManager 0.9.1, 0.9.0, 0.8.1, and possibly other versions, when PolicyKit     is configured to allow users to create new connections, allows local users to execute arbitrary commands     via a newline character in the name for a new network connection, which is not properly handled when     writing to the ifcfg file. (CVE-2011-3364)

  - nm-applet.conf in GNOME NetworkManager before 0.7.0.99 contains an incorrect deny setting, which allows     local users to discover (1) network connection passwords and (2) pre-shared keys via calls to the     GetSecrets method in the dbus request handler. (CVE-2009-0365)

  - GNOME NetworkManager before 0.7.0.99 does not properly verify privileges for dbus (1) modify and (2)     delete requests, which allows local users to change or remove the network connections of arbitrary users     via unspecified vectors related to org.freedesktop.NetworkManagerUserSettings and at_console.
    (CVE-2009-0578)

  - DBus-GLib 0.73 disregards the access flag of exported GObject properties, which allows local users to     bypass intended access restrictions and possibly cause a denial of service by modifying properties, as     demonstrated by properties of the (1) DeviceKit-Power, (2) NetworkManager, and (3) ModemManager services.
    (CVE-2010-1172)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2011-1338 advisory.

    - ifcfg-rh: CVE-2011-3364: filter newline characters when writing into ifcfg-* files (rh #737338)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security issues were identified and fixed in networkmanager :

GNOME NetworkManager before 0.8.6 does not properly enforce the auth_admin element in PolicyKit, which allows local users to bypass intended wireless network sharing restrictions via unspecified vectors (CVE-2011-2176).

Incomplete blacklist vulnerability in the svEscape function in settings/plugins/ifcfg-rh/shvar.c in the ifcfg-rh plug-in for GNOME NetworkManager 0.9.1, 0.9.0, 0.8.1, and possibly other versions, when PolicyKit is configured to allow users to create new connections, allows local users to execute arbitrary commands via a newline character in the name for a new network connection, which is not properly handled when writing to the ifcfg file (CVE-2011-3364).

Instead of patching networkmanager, the latest 0.8.6.0 stable version is being provided due to the large amount of bugs fixed upstream. Also the networkmanager-applet, networkmanager-openconnect, networkmanager-openvpn, networkmanager-pptp, networkmanager-vpnc is being provided with their latest 0.8.6.0 stable versions.

The provided packages solves these security vulnerabilities.

NetworkManager is a network link manager that attempts to keep a wired or

wireless network connection active at all times. The ifcfg-rh

NetworkManager plug-in is used in Scientific Linux distributions to

read and write configuration information from the

/etc/sysconfig/network-scripts/ifcfg-* files.

An input sanitization flaw was found in the way the ifcfg-rh NetworkManager

plug-in escaped network connection names containing special characters. If

PolicyKit was configured to allow local, unprivileged users to create and

save new network connections, they could create a connection with a

specially crafted name, leading to the escalation of their privileges.

Note: By default, PolicyKit prevents unprivileged users from creating and

saving network connections. (CVE-2011-3364)

Users of NetworkManager should upgrade to these updated packages, which

contain a backported patch to correct this issue. Running instances of

NetworkManager must be restarted ('service NetworkManager restart') for

this update to take effect.

This update fixes security issue in ifcfg-rh plugin (CVE-2011-3364).
In addition, it updates to 0.8.6-rc1.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes security issue in ifcfg-rh plugin (CVE-2011-3364).
This update also fixes an applet and connection editor crash caused by mis-packaging of some UI-related files, and corrects the path of iscsiadm. This update further adds the ability to delete connections from nmcli, correctly handles IPv6 link-local DNS servers when using the dnsmasq local caching nameserver plugin, and fixes connection timestamps for VPN connections.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes security issue in ifcfg-rh plugin (CVE-2011-3364).
In addition, it updates to 0.9.1.90 featuring :

  - ability to delete connections from nmcli

    - correctly handles IPv6 link-local DNS servers when       using the dnsmasq local caching nameserver plugin

    - fixes connection timestamps for VPN connections

    - fixes the path of iscsiadm

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2011:1338 advisory.

  - NetworkManager: Console user can escalate to root via newlines in ifcfg-rh connection name (CVE-2011-3364)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
266235	NewStart CGSL MAIN 6.06 : NetworkManager Multiple Vulnerabilities (NS-SA-2025-0213)	Nessus	NewStart CGSL Local Security Checks	high
68358	Oracle Linux 6 : NetworkManager (ELSA-2011-1338)	Nessus	Oracle Linux Local Security Checks	high
61935	Mandriva Linux Security Advisory : networkmanager (MDVSA-2011:171)	Nessus	Mandriva Local Security Checks	medium
61142	Scientific Linux Security Update : NetworkManager on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
56419	Fedora 14 : NetworkManager-0.8.5.92-1.git20110927.fc14 (2011-13401)	Nessus	Fedora Local Security Checks	medium
56370	Fedora 16 : NetworkManager-0.9.1.90-3.git20110927.fc16 (2011-13425)	Nessus	Fedora Local Security Checks	medium
56341	Fedora 15 : NetworkManager-0.9.1.90-1.git20110927.fc15 (2011-13388)	Nessus	Fedora Local Security Checks	medium
56304	RHEL 6 : NetworkManager (RHSA-2011:1338)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2011-3364

high

Tenable Plugins

high

high

medium

medium

medium

medium

medium

high