oss-sec mailing list archives
CVE Request: NetworkManager arbitrary file access
From: Ludwig Nussel <ludwig.nussel () suse de>
Date: Wed, 29 Feb 2012 10:48:19 +0100
Hi, Connections in NetworkManager 0.9 store path names to certificates and key files. That means NM (or rather wpa_supplicant which gets configured by NM) accesses the user's files as root. A user who is allowed to add connections (default for locally logged in users) may specify arbitrary file names. NM happily accepts files of any other user, including root and even device files. Fortunately it's read access only. The safe approach would be to stream the actual content of the certificate and key files to NM and have NM store that directly. In fact NM 0.7 does just that for system connections (but forgets to store the key so those connections won't actually work). NM 0.6 is also affected. Reproducer for NM 0.9 attached, you need to edit the file names and then run e.g. $ nmw.py new wlan0 yourssid cu Ludwig -- (o_ Ludwig Nussel //\ V_/_ http://www.suse.de/ SUSE LINUX Products GmbH, GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer, HRB 16746 (AG Nürnberg)
Attachment:
nmw.py
Description:
Current thread:
- CVE Request: NetworkManager arbitrary file access Ludwig Nussel (Feb 29)
- Re: CVE Request: NetworkManager arbitrary file access Kurt Seifried (Mar 01)