Incomplete blacklist vulnerability in the svEscape function in settings/plugins/ifcfg-rh/shvar.c in the ifcfg-rh plug-in for GNOME NetworkManager 0.9.1, 0.9.0, 0.8.1, and possibly other versions, when PolicyKit is configured to allow users to create new connections, allows local users to execute arbitrary commands via a newline character in the name for a new network connection, which is not properly handled when writing to the ifcfg file.

From Red Hat Security Advisory 2011:1338 :

Updated NetworkManager packages that fix one security issue are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

NetworkManager is a network link manager that attempts to keep a wired or wireless network connection active at all times. The ifcfg-rh NetworkManager plug-in is used in Red Hat Enterprise Linux distributions to read and write configuration information from the /etc/sysconfig/network-scripts/ifcfg-* files.

An input sanitization flaw was found in the way the ifcfg-rh NetworkManager plug-in escaped network connection names containing special characters. If PolicyKit was configured to allow local, unprivileged users to create and save new network connections, they could create a connection with a specially crafted name, leading to the escalation of their privileges. Note: By default, PolicyKit prevents unprivileged users from creating and saving network connections. (CVE-2011-3364)

Red Hat would like to thank Matt McCutchen for reporting this issue.

Users of NetworkManager should upgrade to these updated packages, which contain a backported patch to correct this issue. Running instances of NetworkManager must be restarted ('service NetworkManager restart') for this update to take effect.

Security issues were identified and fixed in networkmanager :

GNOME NetworkManager before 0.8.6 does not properly enforce the auth_admin element in PolicyKit, which allows local users to bypass intended wireless network sharing restrictions via unspecified vectors (CVE-2011-2176).

Incomplete blacklist vulnerability in the svEscape function in settings/plugins/ifcfg-rh/shvar.c in the ifcfg-rh plug-in for GNOME NetworkManager 0.9.1, 0.9.0, 0.8.1, and possibly other versions, when PolicyKit is configured to allow users to create new connections, allows local users to execute arbitrary commands via a newline character in the name for a new network connection, which is not properly handled when writing to the ifcfg file (CVE-2011-3364).

Instead of patching networkmanager, the latest 0.8.6.0 stable version is being provided due to the large amount of bugs fixed upstream. Also the networkmanager-applet, networkmanager-openconnect, networkmanager-openvpn, networkmanager-pptp, networkmanager-vpnc is being provided with their latest 0.8.6.0 stable versions.

The provided packages solves these security vulnerabilities.

NetworkManager is a network link manager that attempts to keep a wired or

wireless network connection active at all times. The ifcfg-rh

NetworkManager plug-in is used in Scientific Linux distributions to

read and write configuration information from the

/etc/sysconfig/network-scripts/ifcfg-* files.

An input sanitization flaw was found in the way the ifcfg-rh NetworkManager

plug-in escaped network connection names containing special characters. If

PolicyKit was configured to allow local, unprivileged users to create and

save new network connections, they could create a connection with a

specially crafted name, leading to the escalation of their privileges.

Note: By default, PolicyKit prevents unprivileged users from creating and

saving network connections. (CVE-2011-3364)

Users of NetworkManager should upgrade to these updated packages, which

contain a backported patch to correct this issue. Running instances of

NetworkManager must be restarted ('service NetworkManager restart') for

this update to take effect.

This update fixes security issue in ifcfg-rh plugin (CVE-2011-3364).
In addition, it updates to 0.8.6-rc1.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes security issue in ifcfg-rh plugin (CVE-2011-3364).
This update also fixes an applet and connection editor crash caused by mis-packaging of some UI-related files, and corrects the path of iscsiadm. This update further adds the ability to delete connections from nmcli, correctly handles IPv6 link-local DNS servers when using the dnsmasq local caching nameserver plugin, and fixes connection timestamps for VPN connections.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes security issue in ifcfg-rh plugin (CVE-2011-3364).
In addition, it updates to 0.9.1.90 featuring :

  - ability to delete connections from nmcli

    - correctly handles IPv6 link-local DNS servers when       using the dnsmasq local caching nameserver plugin

    - fixes connection timestamps for VPN connections

    - fixes the path of iscsiadm

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2011:1338 advisory.

  - NetworkManager: Console user can escalate to root via newlines in ifcfg-rh connection name (CVE-2011-3364)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
68358	Oracle Linux 6 : NetworkManager (ELSA-2011-1338)	Nessus	Oracle Linux Local Security Checks	medium
61935	Mandriva Linux Security Advisory : networkmanager (MDVSA-2011:171)	Nessus	Mandriva Local Security Checks	medium
61142	Scientific Linux Security Update : NetworkManager on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
56419	Fedora 14 : NetworkManager-0.8.5.92-1.git20110927.fc14 (2011-13401)	Nessus	Fedora Local Security Checks	medium
56370	Fedora 16 : NetworkManager-0.9.1.90-3.git20110927.fc16 (2011-13425)	Nessus	Fedora Local Security Checks	medium
56341	Fedora 15 : NetworkManager-0.9.1.90-1.git20110927.fc15 (2011-13388)	Nessus	Fedora Local Security Checks	medium
56304	RHEL 6 : NetworkManager (RHSA-2011:1338)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2011-3364

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

high