NetworkManager security update

ID CESA-2010:0108
Type centos
Reporter CentOS Project
Modified 2010-02-23T00:09:27


CentOS Errata and Security Advisory CESA-2010:0108

NetworkManager is a network link manager that attempts to keep a wired or wireless network connection active at all times.

A missing network certificate verification flaw was found in NetworkManager. If a user created a WPA Enterprise or 802.1x wireless network connection that was verified using a Certificate Authority (CA) certificate, and then later removed that CA certificate file, NetworkManager failed to verify the identity of the network on the following connection attempts. In these situations, a malicious wireless network spoofing the original network could trick a user into disclosing authentication credentials or communicating over an untrusted network. (CVE-2009-4144)

An information disclosure flaw was found in NetworkManager's nm-connection-editor D-Bus interface. If a user edited network connection options using nm-connection-editor, a summary of those changes was broadcasted over the D-Bus message bus, possibly disclosing sensitive information (such as wireless network authentication credentials) to other local users. (CVE-2009-4145)

Users of NetworkManager should upgrade to these updated packages, which contain backported patches to correct these issues.

Merged security bulletin from advisories:

Affected packages: NetworkManager NetworkManager-devel NetworkManager-glib NetworkManager-glib-devel NetworkManager-gnome

Upstream details at: