Home page logo

oss-sec logo oss-sec mailing list archives

CVE Request: NetworkManager arbitrary file access
From: Ludwig Nussel <ludwig.nussel () suse de>
Date: Wed, 29 Feb 2012 10:48:19 +0100


Connections in NetworkManager 0.9 store path names to certificates and
key files. That means NM (or rather wpa_supplicant which gets
configured by NM) accesses the user's files as root. A user who is
allowed to add connections (default for locally logged in users) may
specify arbitrary file names. NM happily accepts files of any other
user, including root and even device files. Fortunately it's read
access only.

The safe approach would be to stream the actual content of the
certificate and key files to NM and have NM store that directly.
In fact NM 0.7 does just that for system connections (but forgets to
store the key so those connections won't actually work).

NM 0.6 is also affected.

Reproducer for NM 0.9 attached, you need to edit the file names and
then run e.g.
$ nmw.py new wlan0 yourssid


 (o_   Ludwig Nussel
 V_/_  http://www.suse.de/
SUSE LINUX Products GmbH, GF: Jeff Hawn, Jennifer Guild, Felix Imend├Ârffer, HRB 16746 (AG N├╝rnberg) 

Attachment: nmw.py

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]