U radu programskog paketa NetworkManager uočena su dva nova sigurnosna propusta koje lokalni napadač može iskoristiti za proizvoljno izvršavanje programskog koda te zaobilaženje postavljenih ograničenja.
Paket:
NetworkManager 0.x
Operacijski sustavi:
Mandriva Linux 2011
Kritičnost:
6
Problem:
neodgovarajuća provjera ulaznih podataka, pogreška u programskoj funkciji
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDVSA-2011:171
http://www.mandriva.com/security/
_______________________________________________________________________
Package : networkmanager
Date : November 11, 2011
Affected: 2011.
_______________________________________________________________________
Problem Description:
Security issues were identified and fixed in networkmanager:
GNOME NetworkManager before 0.8.6 does not properly enforce the
auth_admin element in PolicyKit, which allows local users to bypass
intended wireless network sharing restrictions via unspecified vectors
(CVE-2011-2176).
Incomplete blacklist vulnerability in the svEscape function in
settings/plugins/ifcfg-rh/shvar.c in the ifcfg-rh plug-in for GNOME
NetworkManager 0.9.1, 0.9.0, 0.8.1, and possibly other versions, when
PolicyKit is configured to allow users to create new connections,
allows local users to execute arbitrary commands via a newline
character in the name for a new network connection, which is not
properly handled when writing to the ifcfg file (CVE-2011-3364).
Instead of patching networkmanager, the latest 0.8.6.0 stable
version is being provided due to the large amount of bugs fixed
upstream. Also the networkmanager-applet, networkmanager-openconnect,
networkmanager-openvpn, networkmanager-pptp, networkmanager-vpnc is
being provided with their latest 0.8.6.0 stable versions.
The provided packages solves these security vulnerabilities.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2176
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3364
http://cgit.freedesktop.org/NetworkManager/NetworkManager/plain/NEWS?h=NM_0_8
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2011:
c530bf1caf9f0c7a893dc6fb5c12199e
2011/i586/libnm-glib2-0.8.6.0-0.1-mdv2011.0.i586.rpm
ebc62339c61d69de533ff547424b33da
2011/i586/libnm-glib-devel-0.8.6.0-0.1-mdv2011.0.i586.rpm
5d6f29391291ef36852288cadae40d95
2011/i586/libnm-glib-vpn1-0.8.6.0-0.1-mdv2011.0.i586.rpm
6087abf2686821434eb3afc51912437e
2011/i586/libnm-glib-vpn-devel-0.8.6.0-0.1-mdv2011.0.i586.rpm
b8977f7ed13a0294a7ebbaadee039428
2011/i586/libnm-util1-0.8.6.0-0.1-mdv2011.0.i586.rpm
c1600e19ab5b04e35287079c9be02738
2011/i586/libnm-util-devel-0.8.6.0-0.1-mdv2011.0.i586.rpm
4414ce4ae05cf979afd44680876c8391
2011/i586/networkmanager-0.8.6.0-0.1-mdv2011.0.i586.rpm
958dd23cbafd3b408754a4a579ac22ba
2011/i586/networkmanager-applet-0.8.6.0-0.1-mdv2011.0.i586.rpm
ba3dede9e2b3c1fa30f43bd19039b7ab
2011/i586/networkmanager-openconnect-0.8.6.0-0.1-mdv2011.0.i586.rpm
d50dcbedbde986d3942498fd1f5474b1
2011/i586/networkmanager-openvpn-0.8.6.0-0.1-mdv2011.0.i586.rpm
0f360660a076e002d0159d7ad01dc8ac
2011/i586/networkmanager-pptp-0.8.6.0-0.1-mdv2011.0.i586.rpm
7c55fc8d1ed0039d9f8457778600de5e
2011/i586/networkmanager-vpnc-0.8.6.0-0.1-mdv2011.0.i586.rpm
9646534c9bb96c7f92a63179ae540e7f
2011/SRPMS/networkmanager-0.8.6.0-0.1.src.rpm
fedaf805fc6d4d70a49f4455254a5427
2011/SRPMS/networkmanager-applet-0.8.6.0-0.1.src.rpm
c5bf3fe13685d2a4cdcff69e38db2f3c
2011/SRPMS/networkmanager-openconnect-0.8.6.0-0.1.src.rpm
0eadfcb51e4dbbe140464887b04a7fb8
2011/SRPMS/networkmanager-openvpn-0.8.6.0-0.1.src.rpm
5e85b3b3f14cd6dd9057c9d02cbb2f15
2011/SRPMS/networkmanager-pptp-0.8.6.0-0.1.src.rpm
9c83f344de996d5eb8e76b54b4e23bbe
2011/SRPMS/networkmanager-vpnc-0.8.6.0-0.1.src.rpm
Mandriva Linux 2011/X86_64:
9fe4801401ee1ed6357238051f5bf295
2011/x86_64/lib64nm-glib2-0.8.6.0-0.1-mdv2011.0.x86_64.rpm
b221a9f33856ab77eb3c18c9b39d1fad
2011/x86_64/lib64nm-glib-devel-0.8.6.0-0.1-mdv2011.0.x86_64.rpm
518492246aae82e41b4a11646241ce25
2011/x86_64/lib64nm-glib-vpn1-0.8.6.0-0.1-mdv2011.0.x86_64.rpm
d6972f15d6e98236c1721086ab32a3ba
2011/x86_64/lib64nm-glib-vpn-devel-0.8.6.0-0.1-mdv2011.0.x86_64.rpm
9fb5f213996fb6e4a59351138c51fd34
2011/x86_64/lib64nm-util1-0.8.6.0-0.1-mdv2011.0.x86_64.rpm
d4b5e921aa28d9c55f38eb976c69003f
2011/x86_64/lib64nm-util-devel-0.8.6.0-0.1-mdv2011.0.x86_64.rpm
42737153344129c8196a2b34345a76f6
2011/x86_64/networkmanager-0.8.6.0-0.1-mdv2011.0.x86_64.rpm
70433a01223f7a26156dfac562d7e56c
2011/x86_64/networkmanager-applet-0.8.6.0-0.1-mdv2011.0.x86_64.rpm
19cf7eab0cd01a6c610d40cd0c81cf97
2011/x86_64/networkmanager-openconnect-0.8.6.0-0.1-mdv2011.0.x86_64.rpm
f8a66ca3491630187725bbdeeb9c62ac
2011/x86_64/networkmanager-openvpn-0.8.6.0-0.1-mdv2011.0.x86_64.rpm
edfd577bd13f0c7c23c22d7af9be173a
2011/x86_64/networkmanager-pptp-0.8.6.0-0.1-mdv2011.0.x86_64.rpm
14c16994c828cb316b7004fc31e6dc40
2011/x86_64/networkmanager-vpnc-0.8.6.0-0.1-mdv2011.0.x86_64.rpm
9646534c9bb96c7f92a63179ae540e7f
2011/SRPMS/networkmanager-0.8.6.0-0.1.src.rpm
fedaf805fc6d4d70a49f4455254a5427
2011/SRPMS/networkmanager-applet-0.8.6.0-0.1.src.rpm
c5bf3fe13685d2a4cdcff69e38db2f3c
2011/SRPMS/networkmanager-openconnect-0.8.6.0-0.1.src.rpm
0eadfcb51e4dbbe140464887b04a7fb8
2011/SRPMS/networkmanager-openvpn-0.8.6.0-0.1.src.rpm
5e85b3b3f14cd6dd9057c9d02cbb2f15
2011/SRPMS/networkmanager-pptp-0.8.6.0-0.1.src.rpm
9c83f344de996d5eb8e76b54b4e23bbe
2011/SRPMS/networkmanager-vpnc-0.8.6.0-0.1.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
iD8DBQFOvYFtmqjQ0CJFipgRArZjAKCGJ1eZoOjasWPTsun7ZavWAYkORgCcDIQ4
/nUwNHafrhAwg7aGUxZUP4E=
=vTqc
-----END PGP SIGNATURE-----
Posljednje sigurnosne preporuke