Wicd wicd.conf默认配置本地信息泄露漏洞

BUGTRAQ ID: 33658 CVECAN ID: CVE-2009-0489 Wicd是Linux平台下的开源有线和无线网络管理器。 Wicd的dbus配置文件默认允许任何用户拥有org.wicd.daemon对象，这可能允许用户接收本应发送给wicd守护程序的消息，消息中包含网络凭据等敏感信息。 Wicd = 1.5.8 厂商补丁： Gentoo ------ Gentoo已经为此发布了一个安全公告（GLSA-200904-12）以及相应补丁: GLSA-200904-12：Wicd: Information disclosure...

Wicd information leak

User can hijack DBus messages intended for Wicd server process...

[Full-disclosure] [ GLSA 200904-12 ] Wicd: Information disclosure

Gentoo Linux Security Advisory GLSA 200904-12 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity:...

GLSA-200904-12 : Wicd: Information disclosure

The remote host is affected by the vulnerability described in GLSA-200904-12 Wicd: Information disclosure Tiziano Mueller of Gentoo discovered that the DBus configuration file for Wicd allows arbitrary users to own the org.wicd.daemon object. Impact : A local attacker could exploit this...

Wicd: Information disclosure

Background Wicd is an open source wired and wireless network manager for Linux. Description Tiziano Mueller of Gentoo discovered that the DBus configuration file for Wicd allows arbitrary users to own the org.wicd.daemon object. Impact A local attacker could exploit this vulnerability to receive...

Slackware 12.2 / current : wicd (SSA:2009-040-01)

New wicd packages are available for Slackware 12.2 and -current to fix a security issue with the D-Bus configuration file that could allow local information disclosure such as network credentials. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

CVE-2009-0489

The DBus configuration file for Wicd before 1.5.9 allows arbitrary users to own org.wicd.daemon, which allows local users to receive messages that were intended for the Wicd daemon, possibly including credentials...

Default configuration

The DBus configuration file for Wicd before 1.5.9 allows arbitrary users to own org.wicd.daemon, which allows local users to receive messages that were intended for the Wicd daemon, possibly including credentials...

CVE-2009-0489

The DBus configuration file for Wicd before 1.5.9 allows arbitrary users to own org.wicd.daemon, which allows local users to receive messages that were intended for the Wicd daemon, possibly including credentials...

CVE-2009-0489

CVE-2009-0489 – Wicd information disclosure . The DBus configuration file for Wicd (Linux network manager) allows arbitrary local users to own the org.wicd.daemon object, enabling them to receive messages intended for the Wicd daemon and potentially access credentials. Affected versions are Wicd ...

CVE-2009-0489

The DBus configuration file for Wicd before 1.5.9 allows arbitrary users to own org.wicd.daemon, which allows local users to receive messages that were intended for the Wicd daemon, possibly including credentials...

CVE-2009-0489

Removed by vendor...

wicd

New wicd packages are available for Slackware 12.2 and -current to fix a security issue with the D-Bus configuration file that could allow local information disclosure such as network credentials. More details about this issue may be found in the Common Vulnerabilities and Exposures CVE database:...

CVE-2009-0489: Undefined Security Weakness

The DBus configuration file for Wicd before 1.5.9 allows arbitrary users to own org.wicd.daemon, which allows local users to receive messages that were intended for the Wicd daemon, possibly including credentials...