Description of problem: Between F14 and F15, NetworkManager was changed so that unprivileged console users can store both personal and system connections via the ifcfg-rh plugin. As a result, bug 682290 now constitutes a vulnerability allowing such users to escalate to root. To avoid calling attention to this, I am filing a separate bug rather than updating bug 682290.

Version-Release number of selected component (if applicable): NetworkManager-0.9.0-1.fc15

How reproducible: Always

Steps to Reproduce (as an unprivileged console user): 1. Create a wired connection named test'. 2. Change the name to test\nUSERCTL=true\n/bin/bash', where \n' stands for a newline entered via Ctrl-Shift-U, A. 3. usernetctl test up

Actual results: Root shell.

Expected results: Format integrity of /etc/sysconfig/network-scripts/ifcfg-test is maintained.

GNOME NetworkManager before 0.8.6 does not properly enforce the authadmin element in PolicyKit, which allows local users to bypass intended wireless network sharing restrictions via unspecified vectors.