full-disclosure - [ MDVSA-2011:171 ] networkmanager

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Sat, 12 Nov 2011 00:12:00 +0100
From: security@...driva.com
To: full-disclosure@...ts.grok.org.uk
Subject: [ MDVSA-2011:171 ] networkmanager

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2011:171
 http://www.mandriva.com/security/
 _______________________________________________________________________

 Package : networkmanager
 Date    : November 11, 2011
 Affected: 2011.
 _______________________________________________________________________

 Problem Description:

 Security issues were identified and fixed in networkmanager:
 
 GNOME NetworkManager before 0.8.6 does not properly enforce the
 auth_admin element in PolicyKit, which allows local users to bypass
 intended wireless network sharing restrictions via unspecified vectors
 (CVE-2011-2176).
 
 Incomplete blacklist vulnerability in the svEscape function in
 settings/plugins/ifcfg-rh/shvar.c in the ifcfg-rh plug-in for GNOME
 NetworkManager 0.9.1, 0.9.0, 0.8.1, and possibly other versions, when
 PolicyKit is configured to allow users to create new connections,
 allows local users to execute arbitrary commands via a newline
 character in the name for a new network connection, which is not
 properly handled when writing to the ifcfg file (CVE-2011-3364).
 
 Instead of patching networkmanager, the latest 0.8.6.0 stable
 version is being provided due to the large amount of bugs fixed
 upstream. Also the networkmanager-applet, networkmanager-openconnect,
 networkmanager-openvpn, networkmanager-pptp, networkmanager-vpnc is
 being provided with their latest 0.8.6.0 stable versions.
 
 The provided packages solves these security vulnerabilities.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2176
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3364
 http://cgit.freedesktop.org/NetworkManager/NetworkManager/plain/NEWS?h=NM_0_8
 _______________________________________________________________________

 Updated Packages:

 Mandriva Linux 2011:
 c530bf1caf9f0c7a893dc6fb5c12199e  2011/i586/libnm-glib2-0.8.6.0-0.1-mdv2011.0.i586.rpm
 ebc62339c61d69de533ff547424b33da  2011/i586/libnm-glib-devel-0.8.6.0-0.1-mdv2011.0.i586.rpm
 5d6f29391291ef36852288cadae40d95  2011/i586/libnm-glib-vpn1-0.8.6.0-0.1-mdv2011.0.i586.rpm
 6087abf2686821434eb3afc51912437e  2011/i586/libnm-glib-vpn-devel-0.8.6.0-0.1-mdv2011.0.i586.rpm
 b8977f7ed13a0294a7ebbaadee039428  2011/i586/libnm-util1-0.8.6.0-0.1-mdv2011.0.i586.rpm
 c1600e19ab5b04e35287079c9be02738  2011/i586/libnm-util-devel-0.8.6.0-0.1-mdv2011.0.i586.rpm
 4414ce4ae05cf979afd44680876c8391  2011/i586/networkmanager-0.8.6.0-0.1-mdv2011.0.i586.rpm
 958dd23cbafd3b408754a4a579ac22ba  2011/i586/networkmanager-applet-0.8.6.0-0.1-mdv2011.0.i586.rpm
 ba3dede9e2b3c1fa30f43bd19039b7ab  2011/i586/networkmanager-openconnect-0.8.6.0-0.1-mdv2011.0.i586.rpm
 d50dcbedbde986d3942498fd1f5474b1  2011/i586/networkmanager-openvpn-0.8.6.0-0.1-mdv2011.0.i586.rpm
 0f360660a076e002d0159d7ad01dc8ac  2011/i586/networkmanager-pptp-0.8.6.0-0.1-mdv2011.0.i586.rpm
 7c55fc8d1ed0039d9f8457778600de5e  2011/i586/networkmanager-vpnc-0.8.6.0-0.1-mdv2011.0.i586.rpm 
 9646534c9bb96c7f92a63179ae540e7f  2011/SRPMS/networkmanager-0.8.6.0-0.1.src.rpm
 fedaf805fc6d4d70a49f4455254a5427  2011/SRPMS/networkmanager-applet-0.8.6.0-0.1.src.rpm
 c5bf3fe13685d2a4cdcff69e38db2f3c  2011/SRPMS/networkmanager-openconnect-0.8.6.0-0.1.src.rpm
 0eadfcb51e4dbbe140464887b04a7fb8  2011/SRPMS/networkmanager-openvpn-0.8.6.0-0.1.src.rpm
 5e85b3b3f14cd6dd9057c9d02cbb2f15  2011/SRPMS/networkmanager-pptp-0.8.6.0-0.1.src.rpm
 9c83f344de996d5eb8e76b54b4e23bbe  2011/SRPMS/networkmanager-vpnc-0.8.6.0-0.1.src.rpm

 Mandriva Linux 2011/X86_64:
 9fe4801401ee1ed6357238051f5bf295  2011/x86_64/lib64nm-glib2-0.8.6.0-0.1-mdv2011.0.x86_64.rpm
 b221a9f33856ab77eb3c18c9b39d1fad  2011/x86_64/lib64nm-glib-devel-0.8.6.0-0.1-mdv2011.0.x86_64.rpm
 518492246aae82e41b4a11646241ce25  2011/x86_64/lib64nm-glib-vpn1-0.8.6.0-0.1-mdv2011.0.x86_64.rpm
 d6972f15d6e98236c1721086ab32a3ba  2011/x86_64/lib64nm-glib-vpn-devel-0.8.6.0-0.1-mdv2011.0.x86_64.rpm
 9fb5f213996fb6e4a59351138c51fd34  2011/x86_64/lib64nm-util1-0.8.6.0-0.1-mdv2011.0.x86_64.rpm
 d4b5e921aa28d9c55f38eb976c69003f  2011/x86_64/lib64nm-util-devel-0.8.6.0-0.1-mdv2011.0.x86_64.rpm
 42737153344129c8196a2b34345a76f6  2011/x86_64/networkmanager-0.8.6.0-0.1-mdv2011.0.x86_64.rpm
 70433a01223f7a26156dfac562d7e56c  2011/x86_64/networkmanager-applet-0.8.6.0-0.1-mdv2011.0.x86_64.rpm
 19cf7eab0cd01a6c610d40cd0c81cf97  2011/x86_64/networkmanager-openconnect-0.8.6.0-0.1-mdv2011.0.x86_64.rpm
 f8a66ca3491630187725bbdeeb9c62ac  2011/x86_64/networkmanager-openvpn-0.8.6.0-0.1-mdv2011.0.x86_64.rpm
 edfd577bd13f0c7c23c22d7af9be173a  2011/x86_64/networkmanager-pptp-0.8.6.0-0.1-mdv2011.0.x86_64.rpm
 14c16994c828cb316b7004fc31e6dc40  2011/x86_64/networkmanager-vpnc-0.8.6.0-0.1-mdv2011.0.x86_64.rpm 
 9646534c9bb96c7f92a63179ae540e7f  2011/SRPMS/networkmanager-0.8.6.0-0.1.src.rpm
 fedaf805fc6d4d70a49f4455254a5427  2011/SRPMS/networkmanager-applet-0.8.6.0-0.1.src.rpm
 c5bf3fe13685d2a4cdcff69e38db2f3c  2011/SRPMS/networkmanager-openconnect-0.8.6.0-0.1.src.rpm
 0eadfcb51e4dbbe140464887b04a7fb8  2011/SRPMS/networkmanager-openvpn-0.8.6.0-0.1.src.rpm
 5e85b3b3f14cd6dd9057c9d02cbb2f15  2011/SRPMS/networkmanager-pptp-0.8.6.0-0.1.src.rpm
 9c83f344de996d5eb8e76b54b4e23bbe  2011/SRPMS/networkmanager-vpnc-0.8.6.0-0.1.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iD8DBQFOvYFtmqjQ0CJFipgRArZjAKCGJ1eZoOjasWPTsun7ZavWAYkORgCcDIQ4
/nUwNHafrhAwg7aGUxZUP4E=
=vTqc
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/