CVE-2011-1943: Low severity networkmanager vulnerability
Description of problem:
Password to unlock certificate is logged to /var/log/messages
May 29 19:46:42 localhost NetworkManager[4791]: destroyonesecret: destroying
Version-Release number of selected component (if applicable):
NetworkManager-openvpn-0.8.999-1.fc15.x8664
Additional info:
I would love to have the option to type the password at connection time instead of it being stored, but adding the password to the system log is wrong
Other sources
The destroyonesecret function in nm-setting-vpn.c in libnm-util in the NetworkManager package 0.8.999-3.git20110526 in Fedora 15 creates a log entry containing a certificate password, which allows local users to obtain sensitive information by reading a log file.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-1943?
CVE-2011-1943 is considered to have a medium severity due to sensitive information being logged.
How do I fix CVE-2011-1943?
To fix CVE-2011-1943, ensure you update to a version of NetworkManager that is beyond 0.8.9997.
Which versions are affected by CVE-2011-1943?
CVE-2011-1943 affects NetworkManager versions up to and including 0.8.9997.
What kind of data exposure occurs with CVE-2011-1943?
CVE-2011-1943 exposes passwords used to unlock certificates in the system logs.
Is CVE-2011-1943 specific to any operating system?
Yes, CVE-2011-1943 is particularly noted in Fedora 15 and related packages of NetworkManager.