From Ludwid Nussel:

nm-applet.conf contains the following rules:

<policy context="default"> <allow senddestination="org.freedesktop.NetworkManagerUserSettings"/> <allow sendinterface="org.freedesktop.NetworkManagerSettings"/> <!-- Only root can get secrets --> <deny sendinterface="org.freedesktop.NetworkManagerSettings.Secrets"/>

Ie anyone can call methods on destination org.freedesktop.NetworkManagerUserSettings. There is a line that is supposed to block users from calling the GetSecrets method on the separate interface for secrets. Unfortunately that interface is not called "org.freedesktop.NetworkManagerSettings.Secrets" but "org.freedesktop.NetworkManagerSettings.Connection.Secrets". So the deny statement is useless and any user on the system can fetch the connection secrets. The same problem can be found in nm-system-settings.

Acknowledgements:

Red Hat would like to thank Ludwig Nussel for reporting this flaw responsibly.

Stack-based buffer overflow in the consoptions function in options.c in dhcpd in OpenBSD 4.0 through 4.2, and some other dhcpd implementations based on ISC dhcp-2, allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a DHCP request specifying a maximum message size smaller than the minimum IP MTU.

GNOME screensaver 2.20 in Ubuntu 7.10, when used with Compiz, does not properly reserve input focus, which allows attackers with physical access to take control of the session after entering an Alt-Tab sequence, a related issue to CVE-2007-3069.