CVE-2009-0578: Medium severity Ubuntu Ubuntu Linux vulnerability
GNOME NetworkManager before 0.7.0.99 does not properly verify privileges for dbus (1) modify and (2) delete requests, which allows local users to change or remove the network connections of arbitrary users via unspecified vectors related to org.freedesktop.NetworkManagerUserSettings and atconsole.
Other sources
Ludwig Nussel reported:
Preventing users from reading secrets can be achieved with proper dbus access rules. However having access to org.freedesktop.NetworkManagerUserSettings allows anyone to modify the connection settings of the user owning that service. Restricting access to 'atconsole' doesn't fix the problem as it would still be possible for local users to start a new session or log in on the text console which too would become 'atconsole'.
Acknowledgements:
Red Hat would like to thank Ludwig Nussel for reporting this flaw responsibly.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GNOME NetworkManagerto a version that resolves this vulnerability.Fixed in 0.7.0.99 - Configuration
Configure D-Bus access control rules for org.freedesktop.NetworkManagerUserSettings to prevent non-authorized local users from reading or modifying connection secrets (i.e., deny read/write access to secrets for unprivileged users).
D-Bus (org.freedesktop.NetworkManagerUserSettings) D-Bus access rules = deny read/write access to secrets for unprivileged users
Event History
Frequently Asked Questions
What is the severity of CVE-2009-0578?
CVE-2009-0578 is classified as a moderate severity vulnerability.
How do I fix CVE-2009-0578?
To fix CVE-2009-0578, update GNOME NetworkManager to version 0.7.0.99 or later.
What systems are affected by CVE-2009-0578?
CVE-2009-0578 affects GNOME NetworkManager versions prior to 0.7.0.99 on Ubuntu Linux 8.10.
What kind of attack does CVE-2009-0578 enable?
CVE-2009-0578 allows local users to change or remove the network connections of arbitrary users.
When was CVE-2009-0578 reported?
CVE-2009-0578 was reported in January 2009.