Bug 487722 (CVE-2009-0365)

Summary:	CVE-2009-0365 NetworkManager: GetSecrets disclosure
Product:	[Other] Security Response	Reporter:	Josh Bressers <bressers>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	low
Version:	unspecified	CC:	dcbw, kreilly, mjc, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2009-03-25 14:26:52 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	487776, 487777, 487778, 487779
Bug Blocks:

Description Josh Bressers 2009-02-27 16:52:32 UTC

From Ludwid Nussel:

nm-applet.conf contains the following rules:

<policy context="default">
<allow send_destination="org.freedesktop.NetworkManagerUserSettings"/>
<allow send_interface="org.freedesktop.NetworkManagerSettings"/>
<!-- Only root can get secrets -->
<deny send_interface="org.freedesktop.NetworkManagerSettings.Secrets"/>

Ie anyone can call methods on destination
org.freedesktop.NetworkManagerUserSettings. There is a line that is
supposed to block users from calling the GetSecrets method on the
separate interface for secrets. Unfortunately that interface is not
called "org.freedesktop.NetworkManagerSettings.Secrets" but
"org.freedesktop.NetworkManagerSettings.Connection.Secrets".
So the deny statement is useless and any user on the system can
fetch the connection secrets. The same problem can be found in
nm-system-settings.

Acknowledgements:

Red Hat would like to thank Ludwig Nussel for reporting this flaw responsibly.

Comment 3 Tomas Hoger 2009-03-06 15:29:31 UTC

Public now via:
  http://www.ubuntu.com/usn/USN-727-1

Comment 4 Dan Williams 2009-03-06 21:41:51 UTC

Fedora packages are already in-queue for updates, and Rawhide packages were out on Wednesday night.

Comment 5 Fedora Update System 2009-03-08 19:30:59 UTC

NetworkManager-0.7.0.99-1.fc9, NetworkManager-vpnc-0.7.0.99-1.fc9, NetworkManager-openvpn-0.7.0.99-1.fc9, NetworkManager-pptp-0.7.0.99-1.fc9, NetworkManager-openconnect-0.7.0.99-1.fc9 has been pushed to the Fedora 9 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 6 Fedora Update System 2009-03-08 19:32:28 UTC

NetworkManager-0.7.0.99-1.fc10, knetworkmanager-0.7-0.8.20080926svn.fc10, NetworkManager-vpnc-0.7.0.99-1.fc10, NetworkManager-openvpn-0.7.0.99-1.fc10, NetworkManager-pptp-0.7.0.99-1.fc10, NetworkManager-openconnect-0.7.0.99-1.fc10 has been pushed to the Fedora 10 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 8 errata-xmlrpc 2009-03-25 13:57:47 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2009:0361 https://rhn.redhat.com/errata/RHSA-2009-0361.html

Comment 9 errata-xmlrpc 2009-03-25 13:58:53 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 4

Via RHSA-2009:0362 https://rhn.redhat.com/errata/RHSA-2009-0362.html

Comment 10 Red Hat Product Security 2009-03-25 14:26:52 UTC

This issue was addressed in:

Red Hat Enterprise Linux:
  http://rhn.redhat.com/errata/RHSA-2009-0361.html
  http://rhn.redhat.com/errata/RHSA-2009-0362.html

Fedora:
  https://admin.fedoraproject.org/updates/F10/FEDORA-2009-2419
  https://admin.fedoraproject.org/updates/F9/FEDORA-2009-2420