Bug 799194 - NetworkManager 0.9 arbitrary file access
NetworkManager 0.9 arbitrary file access
Status: CLOSED DUPLICATE of bug 769807
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
All Linux
low Severity low
: ---
: ---
Assigned To: Red Hat Product Security
: Security
Depends On:
  Show dependency treegraph
Reported: 2012-03-02 00:46 EST by Kurt Seifried
Modified: 2012-03-02 03:42 EST (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2012-03-02 03:42:11 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Kurt Seifried 2012-03-02 00:46:52 EST
From Ludwig Nussel[1]


Connections in NetworkManager 0.9 store path names to certificates and
key files. That means NM (or rather wpa_supplicant which gets
configured by NM) accesses the user's files as root. A user who is
allowed to add connections (default for locally logged in users) may
specify arbitrary file names. NM happily accepts files of any other
user, including root and even device files. Fortunately it's read
access only.

The safe approach would be to stream the actual content of the
certificate and key files to NM and have NM store that directly.
In fact NM 0.7 does just that for system connections (but forgets to
store the key so those connections won't actually work).

NM 0.6 is also affected.

Reproducer for NM 0.9 attached, you need to edit the file names and
then run e.g.
$ nmw.py new wlan0 yourssid


[1] http://seclists.org/oss-sec/2012/q1/513
Comment 2 Kurt Seifried 2012-03-02 01:14:39 EST
Created NetworkManager tracking bugs for this issue

Affects: fedora-all [bug 799202]
Comment 3 Jan Lieskovsky 2012-03-02 03:42:11 EST

*** This bug has been marked as a duplicate of bug 769807 ***

Note You need to log in before you can comment on or make changes to this bug.