Vulnerabilities > CVE-2006-7246 - Improper Certificate Validation vulnerability in multiple products

047910
CVSS 6.8 - MEDIUM
Attack vector
ADJACENT_NETWORK
Attack complexity
HIGH
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
NONE
high complexity
gnome
opensuse
suse
CWE-295
nessus
NVD
Published: 2020-01-27
Updated: 2020-01-31

Summary

NetworkManager 0.9.x does not pin a certificate's subject to an ESSID when 802.11X authentication is used.

Vulnerable Configurations

Part Description Count
Application
Gnome
23
OS
Opensuse
3
OS
Suse
2

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Creating a Rogue Certificate Authority Certificate
    An attacker exploits a weakness in the MD5 hash algorithm (weak collision resistance) to generate a certificate signing request (CSR) that contains collision blocks in the "to be signed" part. The attacker specially crafts two different, but valid X.509 certificates that when hashed with the MD5 algorithm would yield the same value. The attacker then sends the CSR for one of the certificates to the Certification Authority which uses the MD5 hashing algorithm. That request is completely valid and the Certificate Authority issues an X.509 certificate to the attacker which is signed with its private key. An attacker then takes that signed blob and inserts it into another X.509 certificate that the attacker generated. Due to the MD5 collision, both certificates, though different, hash to the same value and so the signed blob works just as well in the second certificate. The net effect is that the attackers' second X.509 certificate, which the Certification Authority has never seen, is now signed and validated by that Certification Authority. To make the attack more interesting, the second certificate could be not just a regular certificate, but rather itself a signing certificate. Thus the attacker is able to start their own Certification Authority that is anchored in its root of trust in the legitimate Certification Authority that has signed the attackers' first X.509 certificate. If the original Certificate Authority was accepted by default by browsers, so will now the Certificate Authority set up by the attacker and of course any certificates that it signs. So the attacker is now able to generate any SSL certificates to impersonate any web server, and the user's browser will not issue any warning to the victim. This can be used to compromise HTTPS communications and other types of systems where PKI and X.509 certificates may be used (e.g., VPN, IPSec) .

Nessus

  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2016-CD218EEF79.NASL
    descriptionUpdate to NetworkManager 1.2-beta3. Upstream release announcement: https://mail.gnome.org/archives/networkmanager-list/2016-March/msg0016 4.html Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-05
    modified2016-04-05
    plugin id90332
    published2016-04-05
    reporterThis script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/90332
    titleFedora 24 : NetworkManager-fortisslvpn-1.2.0-0.4.beta3.fc24 / etc (2016-cd218eef79)
    code
    #%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Fedora Security Advisory 2016-cd218eef79.
#

include("compat.inc");

if (description)
{
  script_id(90332);
  script_version("2.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");

  script_cve_id("CVE-2006-7246");
  script_xref(name:"FEDORA", value:"2016-cd218eef79");

  script_name(english:"Fedora 24 : NetworkManager-fortisslvpn-1.2.0-0.4.beta3.fc24 / etc (2016-cd218eef79)");
  script_summary(english:"Checks rpm output for the updated packages.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Fedora host is missing one or more security updates."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Update to NetworkManager 1.2-beta3. Upstream release announcement:
https://mail.gnome.org/archives/networkmanager-list/2016-March/msg0016
4.html

Note that Tenable Network Security has extracted the preceding
description block directly from the Fedora security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.redhat.com/show_bug.cgi?id=756418"
  );
  # https://lists.fedoraproject.org/pipermail/package-announce/2016-April/181053.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?ef0aa1d6"
  );
  # https://lists.fedoraproject.org/pipermail/package-announce/2016-April/181054.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?be9bf64b"
  );
  # https://lists.fedoraproject.org/pipermail/package-announce/2016-April/181055.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?e2236ed4"
  );
  # https://lists.fedoraproject.org/pipermail/package-announce/2016-April/181056.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?e3a6233e"
  );
  # https://lists.fedoraproject.org/pipermail/package-announce/2016-April/181057.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?d1703ee9"
  );
  # https://lists.fedoraproject.org/pipermail/package-announce/2016-April/181058.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?5c3a26ac"
  );
  # https://lists.fedoraproject.org/pipermail/package-announce/2016-April/181059.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?dd76fb6a"
  );
  # https://lists.fedoraproject.org/pipermail/package-announce/2016-April/181060.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?6aec5022"
  );
  # https://lists.fedoraproject.org/pipermail/package-announce/2016-April/181061.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?164f665c"
  );
  # https://mail.gnome.org/archives/networkmanager-list/2016-March/msg00164.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?5127be46"
  );
  script_set_attribute(attribute:"solution", value:"Update the affected packages.");
  script_set_attribute(attribute:"risk_factor", value:"High");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:NetworkManager");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:NetworkManager-fortisslvpn");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:NetworkManager-libreswan");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:NetworkManager-openconnect");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:NetworkManager-openvpn");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:NetworkManager-pptp");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:NetworkManager-strongswan");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:NetworkManager-vpnc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:network-manager-applet");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:24");

  script_set_attribute(attribute:"patch_publication_date", value:"2016/04/02");
  script_set_attribute(attribute:"plugin_publication_date", value:"2016/04/05");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2016-2020 Tenable Network Security, Inc.");
  script_family(english:"Fedora Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
os_ver = os_ver[1];
if (! ereg(pattern:"^24([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 24.x", "Fedora " + os_ver);

if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);

flag = 0;
if (rpm_check(release:"FC24", reference:"NetworkManager-1.2.0-0.8.beta3.fc24")) flag++;
if (rpm_check(release:"FC24", reference:"NetworkManager-fortisslvpn-1.2.0-0.4.beta3.fc24")) flag++;
if (rpm_check(release:"FC24", reference:"NetworkManager-libreswan-1.2.0-0.4.beta3.fc24")) flag++;
if (rpm_check(release:"FC24", reference:"NetworkManager-openconnect-1.2.0-0.3.beta3.fc24")) flag++;
if (rpm_check(release:"FC24", reference:"NetworkManager-openvpn-1.2.0-0.3.beta3.fc24")) flag++;
if (rpm_check(release:"FC24", reference:"NetworkManager-pptp-1.2.0-0.3.beta3.fc24")) flag++;
if (rpm_check(release:"FC24", reference:"NetworkManager-strongswan-1.3.1-3.20160330libnm.fc24")) flag++;
if (rpm_check(release:"FC24", reference:"NetworkManager-vpnc-1.2.0-0.4.beta3.fc24")) flag++;
if (rpm_check(release:"FC24", reference:"network-manager-applet-1.2.0-0.3.beta3.fc24")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
  else security_hole(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "NetworkManager / NetworkManager-fortisslvpn / etc");
}
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_NETWORKMANAGER-111104.NASL
    descriptionNetworkManager did not pin a certificate
    last seen2020-06-01
    modified2020-06-02
    plugin id57085
    published2011-12-13
    reporterThis script is Copyright (C) 2011-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/57085
    titleSuSE 11.1 Security Update : NetworkManager (SAT Patch Number 5381)
    code
    #%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from SuSE 11 update information. The text itself is
# copyright (C) Novell, Inc.
#

include("compat.inc");

if (description)
{
  script_id(57085);
  script_version("1.5");
  script_cvs_date("Date: 2019/10/25 13:36:42");

  script_cve_id("CVE-2006-7246");

  script_name(english:"SuSE 11.1 Security Update : NetworkManager (SAT Patch Number 5381)");
  script_summary(english:"Checks rpm output for the updated packages");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote SuSE 11 host is missing one or more security updates."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"NetworkManager did not pin a certificate's subject to an ESSID. A
rogue access point could therefore be used to conduct MITM attacks by
using any other valid certificate issued by same CA as used in the
original network (CVE-2006-7246). This has been fixed.

Please note that existing WPA2 Enterprise connections need to be
deleted and re-created to take advantage of the new security checks."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.novell.com/show_bug.cgi?id=574266"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.novell.com/show_bug.cgi?id=686093"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.novell.com/show_bug.cgi?id=694218"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2006-7246.html"
  );
  script_set_attribute(attribute:"solution", value:"Apply SAT patch number 5381.");
  script_set_attribute(attribute:"risk_factor", value:"High");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:NetworkManager");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:NetworkManager-glib");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:NetworkManager-gnome");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:wpa_supplicant");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:wpa_supplicant-gui");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:11");

  script_set_attribute(attribute:"patch_publication_date", value:"2011/11/04");
  script_set_attribute(attribute:"plugin_publication_date", value:"2011/12/13");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2011-2019 Tenable Network Security, Inc.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/SuSE/release");
if (isnull(release) || release !~ "^(SLED|SLES)11") audit(AUDIT_OS_NOT, "SuSE 11");
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SuSE 11", cpu);

pl = get_kb_item("Host/SuSE/patchlevel");
if (isnull(pl) || int(pl) != 1) audit(AUDIT_OS_NOT, "SuSE 11.1");


flag = 0;
if (rpm_check(release:"SLED11", sp:1, cpu:"i586", reference:"NetworkManager-0.7.1_git20090811-3.9.9.5")) flag++;
if (rpm_check(release:"SLED11", sp:1, cpu:"i586", reference:"NetworkManager-glib-0.7.1_git20090811-3.9.9.5")) flag++;
if (rpm_check(release:"SLED11", sp:1, cpu:"i586", reference:"NetworkManager-gnome-0.7.1-5.15.7.5")) flag++;
if (rpm_check(release:"SLED11", sp:1, cpu:"i586", reference:"wpa_supplicant-0.6.9-4.5.4")) flag++;
if (rpm_check(release:"SLED11", sp:1, cpu:"i586", reference:"wpa_supplicant-gui-0.6.9-4.5.4")) flag++;
if (rpm_check(release:"SLED11", sp:1, cpu:"x86_64", reference:"NetworkManager-0.7.1_git20090811-3.9.9.5")) flag++;
if (rpm_check(release:"SLED11", sp:1, cpu:"x86_64", reference:"NetworkManager-glib-0.7.1_git20090811-3.9.9.5")) flag++;
if (rpm_check(release:"SLED11", sp:1, cpu:"x86_64", reference:"NetworkManager-gnome-0.7.1-5.15.7.5")) flag++;
if (rpm_check(release:"SLED11", sp:1, cpu:"x86_64", reference:"wpa_supplicant-0.6.9-4.5.4")) flag++;
if (rpm_check(release:"SLED11", sp:1, cpu:"x86_64", reference:"wpa_supplicant-gui-0.6.9-4.5.4")) flag++;
if (rpm_check(release:"SLES11", sp:1, cpu:"i586", reference:"NetworkManager-0.7.1_git20090811-3.9.9.5")) flag++;
if (rpm_check(release:"SLES11", sp:1, cpu:"i586", reference:"NetworkManager-glib-0.7.1_git20090811-3.9.9.5")) flag++;
if (rpm_check(release:"SLES11", sp:1, cpu:"i586", reference:"NetworkManager-gnome-0.7.1-5.15.7.5")) flag++;
if (rpm_check(release:"SLES11", sp:1, cpu:"i586", reference:"wpa_supplicant-0.6.9-4.5.4")) flag++;
if (rpm_check(release:"SLES11", sp:1, cpu:"x86_64", reference:"NetworkManager-0.7.1_git20090811-3.9.9.5")) flag++;
if (rpm_check(release:"SLES11", sp:1, cpu:"x86_64", reference:"NetworkManager-glib-0.7.1_git20090811-3.9.9.5")) flag++;
if (rpm_check(release:"SLES11", sp:1, cpu:"x86_64", reference:"NetworkManager-gnome-0.7.1-5.15.7.5")) flag++;
if (rpm_check(release:"SLES11", sp:1, cpu:"x86_64", reference:"wpa_supplicant-0.6.9-4.5.4")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
  else security_hole(0);
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_NETWORKMANAGER-111105.NASL
    descriptionNetworkManager did not pin a certificate
    last seen2020-06-01
    modified2020-06-02
    plugin id57086
    published2011-12-13
    reporterThis script is Copyright (C) 2011-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/57086
    titleSuSE 11.1 Security Update : NetworkManager (SAT Patch Number 5381)
    code
    #%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from SuSE 11 update information. The text itself is
# copyright (C) Novell, Inc.
#

include("compat.inc");

if (description)
{
  script_id(57086);
  script_version("1.5");
  script_cvs_date("Date: 2019/10/25 13:36:42");

  script_cve_id("CVE-2006-7246");

  script_name(english:"SuSE 11.1 Security Update : NetworkManager (SAT Patch Number 5381)");
  script_summary(english:"Checks rpm output for the updated packages");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote SuSE 11 host is missing one or more security updates."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"NetworkManager did not pin a certificate's subject to an ESSID. A
rogue access point could therefore be used to conduct MITM attacks by
using any other valid certificate issued by same CA as used in the
original network (CVE-2006-7246). This has been fixed.

Please note that existing WPA2 Enterprise connections need to be
deleted and re-created to take advantage of the new security checks."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.novell.com/show_bug.cgi?id=574266"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.novell.com/show_bug.cgi?id=686093"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.novell.com/show_bug.cgi?id=694218"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2006-7246.html"
  );
  script_set_attribute(attribute:"solution", value:"Apply SAT patch number 5381.");
  script_set_attribute(attribute:"risk_factor", value:"High");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:NetworkManager");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:NetworkManager-glib");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:NetworkManager-gnome");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:wpa_supplicant");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:11");

  script_set_attribute(attribute:"patch_publication_date", value:"2011/11/05");
  script_set_attribute(attribute:"plugin_publication_date", value:"2011/12/13");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2011-2019 Tenable Network Security, Inc.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/SuSE/release");
if (isnull(release) || release !~ "^(SLED|SLES)11") audit(AUDIT_OS_NOT, "SuSE 11");
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SuSE 11", cpu);

pl = get_kb_item("Host/SuSE/patchlevel");
if (isnull(pl) || int(pl) != 1) audit(AUDIT_OS_NOT, "SuSE 11.1");


flag = 0;
if (rpm_check(release:"SLES11", sp:1, cpu:"s390x", reference:"NetworkManager-0.7.1_git20090811-3.9.9.5")) flag++;
if (rpm_check(release:"SLES11", sp:1, cpu:"s390x", reference:"NetworkManager-glib-0.7.1_git20090811-3.9.9.5")) flag++;
if (rpm_check(release:"SLES11", sp:1, cpu:"s390x", reference:"NetworkManager-gnome-0.7.1-5.15.7.5")) flag++;
if (rpm_check(release:"SLES11", sp:1, cpu:"s390x", reference:"wpa_supplicant-0.6.9-4.5.4")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
  else security_hole(0);
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_3_NETWORKMANAGER-111104.NASL
    descriptionNetworkManager did not pin a certificate
    last seen2020-06-01
    modified2020-06-02
    plugin id75683
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/75683
    titleopenSUSE Security Update : NetworkManager (openSUSE-SU-2011:1273-1)
    code
    #%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from openSUSE Security Update NetworkManager-5373.
#
# The text description of this plugin is (C) SUSE LLC.
#

include("compat.inc");

if (description)
{
  script_id(75683);
  script_version("1.5");
  script_cvs_date("Date: 2019/10/25 13:36:41");

  script_cve_id("CVE-2006-7246", "CVE-2011-2176");

  script_name(english:"openSUSE Security Update : NetworkManager (openSUSE-SU-2011:1273-1)");
  script_summary(english:"Check for the NetworkManager-5373 patch");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote openSUSE host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"NetworkManager did not pin a certificate's subject to an ESSID. A
rogue access point could therefore be used to conduct MITM attacks by
using any other valid certificate issued by same CA as used in the
original network (CVE-2006-7246).

Please note that existing WPA2 Enterprise connections need to be
deleted and re-created to take advantage of the new security checks.

NetworkManager did not honor the PolicyKit auth_admin setting when
creating Ad-Hoc wireless networks (CVE-2011-2176)"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.novell.com/show_bug.cgi?id=574266"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.novell.com/show_bug.cgi?id=702016"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://lists.opensuse.org/opensuse-updates/2011-11/msg00025.html"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected NetworkManager packages."
  );
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:N");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:NetworkManager");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:NetworkManager-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:NetworkManager-glib");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:NetworkManager-gnome");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:wpa_supplicant");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:wpa_supplicant-gui");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:11.3");

  script_set_attribute(attribute:"patch_publication_date", value:"2011/11/04");
  script_set_attribute(attribute:"plugin_publication_date", value:"2014/06/13");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/SuSE/release");
if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
if (release !~ "^(SUSE11\.3)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "11.3", release);
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

ourarch = get_kb_item("Host/cpu");
if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);

flag = 0;

if ( rpm_check(release:"SUSE11.3", reference:"NetworkManager-0.8-8.13.1") ) flag++;
if ( rpm_check(release:"SUSE11.3", reference:"NetworkManager-devel-0.8-8.13.1") ) flag++;
if ( rpm_check(release:"SUSE11.3", reference:"NetworkManager-glib-0.8-8.13.1") ) flag++;
if ( rpm_check(release:"SUSE11.3", reference:"NetworkManager-gnome-0.8-6.3.2") ) flag++;
if ( rpm_check(release:"SUSE11.3", reference:"wpa_supplicant-0.7.1-5.3.1") ) flag++;
if ( rpm_check(release:"SUSE11.3", reference:"wpa_supplicant-gui-0.7.1-5.3.1") ) flag++;

if (flag)
{
  if (report_verbosity > 0) security_note(port:0, extra:rpm_report_get());
  else security_note(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "NetworkManager / NetworkManager-devel / NetworkManager-glib / etc");
}
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2011-15.NASL
    descriptionNetworkManager did not pin a certificate
    last seen2020-06-01
    modified2020-06-02
    plugin id74520
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/74520
    titleopenSUSE Security Update : NetworkManager-gnome / NetworkManager / wpa_supplicant / etc (openSUSE-2011-15)
    code
    #%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from openSUSE Security Update openSUSE-2011-15.
#
# The text description of this plugin is (C) SUSE LLC.
#

include("compat.inc");

if (description)
{
  script_id(74520);
  script_version("1.3");
  script_cvs_date("Date: 2019/10/25 13:36:40");

  script_cve_id("CVE-2006-7246");

  script_name(english:"openSUSE Security Update : NetworkManager-gnome / NetworkManager / wpa_supplicant / etc (openSUSE-2011-15)");
  script_summary(english:"Check for the openSUSE-2011-15 patch");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote openSUSE host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"NetworkManager did not pin a certificate's subject to an ESSID. A
rogue access point could therefore be used to conduct MITM attacks by
using any other valid certificate issued by same CA as used in the
original network (CVE-2006-7246).

Please note that existing WPA2 Enterprise connections need to be
deleted and re-created to take advantage of the new security checks."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.novell.com/show_bug.cgi?id=574266"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected NetworkManager-gnome / NetworkManager / wpa_supplicant / etc packages."
  );
  script_set_attribute(attribute:"risk_factor", value:"High");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:NetworkManager");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:NetworkManager-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:NetworkManager-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:NetworkManager-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:NetworkManager-devel-32bit");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:NetworkManager-gnome");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:NetworkManager-gnome-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:NetworkManager-gnome-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:NetworkManager-gnome-lang");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:NetworkManager-lang");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:gnome-control-center");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:gnome-control-center-branding-upstream");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:gnome-control-center-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:gnome-control-center-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:gnome-control-center-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:gnome-control-center-lang");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:gnome-control-center-user-faces");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libgnome-control-center1");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libgnome-control-center1-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libnm-glib-vpn1");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libnm-glib-vpn1-32bit");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libnm-glib-vpn1-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libnm-glib-vpn1-debuginfo-32bit");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libnm-glib4");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libnm-glib4-32bit");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libnm-glib4-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libnm-glib4-debuginfo-32bit");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libnm-gtk-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libnm-gtk0");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libnm-gtk0-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libnm-util2");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libnm-util2-32bit");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libnm-util2-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libnm-util2-debuginfo-32bit");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:wpa_supplicant");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:wpa_supplicant-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:wpa_supplicant-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:wpa_supplicant-gui");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:wpa_supplicant-gui-debuginfo");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:12.1");

  script_set_attribute(attribute:"patch_publication_date", value:"2011/11/22");
  script_set_attribute(attribute:"plugin_publication_date", value:"2014/06/13");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2014-2019 Tenable Network Security, Inc.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/SuSE/release");
if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
if (release !~ "^(SUSE12\.1)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "12.1", release);
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

ourarch = get_kb_item("Host/cpu");
if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);

flag = 0;

if ( rpm_check(release:"SUSE12.1", reference:"NetworkManager-0.9.1.90-4.3.1") ) flag++;
if ( rpm_check(release:"SUSE12.1", reference:"NetworkManager-debuginfo-0.9.1.90-4.3.1") ) flag++;
if ( rpm_check(release:"SUSE12.1", reference:"NetworkManager-debugsource-0.9.1.90-4.3.1") ) flag++;
if ( rpm_check(release:"SUSE12.1", reference:"NetworkManager-devel-0.9.1.90-4.3.1") ) flag++;
if ( rpm_check(release:"SUSE12.1", reference:"NetworkManager-gnome-0.9.1.90-3.4.1") ) flag++;
if ( rpm_check(release:"SUSE12.1", reference:"NetworkManager-gnome-debuginfo-0.9.1.90-3.4.1") ) flag++;
if ( rpm_check(release:"SUSE12.1", reference:"NetworkManager-gnome-debugsource-0.9.1.90-3.4.1") ) flag++;
if ( rpm_check(release:"SUSE12.1", reference:"NetworkManager-gnome-lang-0.9.1.90-3.4.1") ) flag++;
if ( rpm_check(release:"SUSE12.1", reference:"NetworkManager-lang-0.9.1.90-4.3.1") ) flag++;
if ( rpm_check(release:"SUSE12.1", reference:"gnome-control-center-3.2.1-2.4.1") ) flag++;
if ( rpm_check(release:"SUSE12.1", reference:"gnome-control-center-branding-upstream-3.2.1-2.4.1") ) flag++;
if ( rpm_check(release:"SUSE12.1", reference:"gnome-control-center-debuginfo-3.2.1-2.4.1") ) flag++;
if ( rpm_check(release:"SUSE12.1", reference:"gnome-control-center-debugsource-3.2.1-2.4.1") ) flag++;
if ( rpm_check(release:"SUSE12.1", reference:"gnome-control-center-devel-3.2.1-2.4.1") ) flag++;
if ( rpm_check(release:"SUSE12.1", reference:"gnome-control-center-lang-3.2.1-2.4.1") ) flag++;
if ( rpm_check(release:"SUSE12.1", reference:"gnome-control-center-user-faces-3.2.1-2.4.1") ) flag++;
if ( rpm_check(release:"SUSE12.1", reference:"libgnome-control-center1-3.2.1-2.4.1") ) flag++;
if ( rpm_check(release:"SUSE12.1", reference:"libgnome-control-center1-debuginfo-3.2.1-2.4.1") ) flag++;
if ( rpm_check(release:"SUSE12.1", reference:"libnm-glib-vpn1-0.9.1.90-4.3.1") ) flag++;
if ( rpm_check(release:"SUSE12.1", reference:"libnm-glib-vpn1-debuginfo-0.9.1.90-4.3.1") ) flag++;
if ( rpm_check(release:"SUSE12.1", reference:"libnm-glib4-0.9.1.90-4.3.1") ) flag++;
if ( rpm_check(release:"SUSE12.1", reference:"libnm-glib4-debuginfo-0.9.1.90-4.3.1") ) flag++;
if ( rpm_check(release:"SUSE12.1", reference:"libnm-gtk-devel-0.9.1.90-3.4.1") ) flag++;
if ( rpm_check(release:"SUSE12.1", reference:"libnm-gtk0-0.9.1.90-3.4.1") ) flag++;
if ( rpm_check(release:"SUSE12.1", reference:"libnm-gtk0-debuginfo-0.9.1.90-3.4.1") ) flag++;
if ( rpm_check(release:"SUSE12.1", reference:"libnm-util2-0.9.1.90-4.3.1") ) flag++;
if ( rpm_check(release:"SUSE12.1", reference:"libnm-util2-debuginfo-0.9.1.90-4.3.1") ) flag++;
if ( rpm_check(release:"SUSE12.1", reference:"wpa_supplicant-0.7.3-10.3.1") ) flag++;
if ( rpm_check(release:"SUSE12.1", reference:"wpa_supplicant-debuginfo-0.7.3-10.3.1") ) flag++;
if ( rpm_check(release:"SUSE12.1", reference:"wpa_supplicant-debugsource-0.7.3-10.3.1") ) flag++;
if ( rpm_check(release:"SUSE12.1", reference:"wpa_supplicant-gui-0.7.3-10.3.1") ) flag++;
if ( rpm_check(release:"SUSE12.1", reference:"wpa_supplicant-gui-debuginfo-0.7.3-10.3.1") ) flag++;
if ( rpm_check(release:"SUSE12.1", cpu:"x86_64", reference:"NetworkManager-devel-32bit-0.9.1.90-4.3.1") ) flag++;
if ( rpm_check(release:"SUSE12.1", cpu:"x86_64", reference:"libnm-glib-vpn1-32bit-0.9.1.90-4.3.1") ) flag++;
if ( rpm_check(release:"SUSE12.1", cpu:"x86_64", reference:"libnm-glib-vpn1-debuginfo-32bit-0.9.1.90-4.3.1") ) flag++;
if ( rpm_check(release:"SUSE12.1", cpu:"x86_64", reference:"libnm-glib4-32bit-0.9.1.90-4.3.1") ) flag++;
if ( rpm_check(release:"SUSE12.1", cpu:"x86_64", reference:"libnm-glib4-debuginfo-32bit-0.9.1.90-4.3.1") ) flag++;
if ( rpm_check(release:"SUSE12.1", cpu:"x86_64", reference:"libnm-util2-32bit-0.9.1.90-4.3.1") ) flag++;
if ( rpm_check(release:"SUSE12.1", cpu:"x86_64", reference:"libnm-util2-debuginfo-32bit-0.9.1.90-4.3.1") ) flag++;

if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
  else security_hole(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libnm-gtk0-debuginfo / NetworkManager-gnome-debuginfo / etc");
}
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_NETWORKMANAGER-GNOME-120110.NASL
    descriptionNetworkManager did not pin a certificate
    last seen2020-06-05
    modified2012-02-16
    plugin id57972
    published2012-02-16
    reporterThis script is Copyright (C) 2012-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/57972
    titleSuSE 11.1 Security Update : NetworkManager-gnome (SAT Patch Number 5621)
    code
    #%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from SuSE 11 update information. The text itself is
# copyright (C) Novell, Inc.
#

include("compat.inc");

if (description)
{
  script_id(57972);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");

  script_cve_id("CVE-2006-7246");

  script_name(english:"SuSE 11.1 Security Update : NetworkManager-gnome (SAT Patch Number 5621)");
  script_summary(english:"Checks rpm output for the updated package");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote SuSE 11 host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"NetworkManager did not pin a certificate's subject to an ESSID. A
rogue access point could therefore be used to conduct MITM attacks by
using any other valid certificate issued by same CA as used in the
original network. (CVE-2006-7246)

Please note that existing WPA2 Enterprise connections need to be
deleted and re-created to take advantage of the new security checks.

This is a re-release of the previous update to also enable the checks
for EAP-TLS."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.novell.com/show_bug.cgi?id=574266"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.novell.com/show_bug.cgi?id=732700"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2006-7246.html"
  );
  script_set_attribute(attribute:"solution", value:"Apply SAT patch number 5621.");
  script_set_attribute(attribute:"risk_factor", value:"High");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:NetworkManager-gnome");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:11");

  script_set_attribute(attribute:"patch_publication_date", value:"2012/01/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2012/02/16");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2012-2020 Tenable Network Security, Inc.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/SuSE/release");
if (isnull(release) || release !~ "^(SLED|SLES)11") audit(AUDIT_OS_NOT, "SuSE 11");
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SuSE 11", cpu);

pl = get_kb_item("Host/SuSE/patchlevel");
if (isnull(pl) || int(pl) != 1) audit(AUDIT_OS_NOT, "SuSE 11.1");


flag = 0;
if (rpm_check(release:"SLED11", sp:1, cpu:"i586", reference:"NetworkManager-gnome-0.7.1-5.15.11.1")) flag++;
if (rpm_check(release:"SLED11", sp:1, cpu:"x86_64", reference:"NetworkManager-gnome-0.7.1-5.15.11.1")) flag++;
if (rpm_check(release:"SLES11", sp:1, reference:"NetworkManager-gnome-0.7.1-5.15.11.1")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
  else security_hole(0);
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_3_NETWORKMANAGER-GNOME-120110.NASL
    descriptionNetworkManager did not pin a certificate
    last seen2020-06-05
    modified2014-06-13
    plugin id75684
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/75684
    titleopenSUSE Security Update : NetworkManager-gnome (openSUSE-SU-2012:0101-1)
    code
    #%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from openSUSE Security Update NetworkManager-gnome-5627.
#
# The text description of this plugin is (C) SUSE LLC.
#

include("compat.inc");

if (description)
{
  script_id(75684);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");

  script_cve_id("CVE-2006-7246");

  script_name(english:"openSUSE Security Update : NetworkManager-gnome (openSUSE-SU-2012:0101-1)");
  script_summary(english:"Check for the NetworkManager-gnome-5627 patch");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote openSUSE host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"NetworkManager did not pin a certificate's subject to an ESSID. A
rogue access point could therefore be used to conduct MITM attacks by
using any other valid certificate issued by same CA as used in the
original network (CVE-2006-7246).

Please note that existing WPA2 Enterprise connections need to be
deleted and re-created to take advantage of the new security checks. 

This is a re-release of the previous update to also enable the checks
for EAP-TLS."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.novell.com/show_bug.cgi?id=574266"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.novell.com/show_bug.cgi?id=732700"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://lists.opensuse.org/opensuse-updates/2012-01/msg00036.html"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected NetworkManager-gnome package."
  );
  script_set_attribute(attribute:"risk_factor", value:"Medium");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:NetworkManager-gnome");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:11.3");

  script_set_attribute(attribute:"patch_publication_date", value:"2012/01/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2014/06/13");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/SuSE/release");
if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
if (release !~ "^(SUSE11\.3)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "11.3", release);
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

ourarch = get_kb_item("Host/cpu");
if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);

flag = 0;

if ( rpm_check(release:"SUSE11.3", reference:"NetworkManager-gnome-0.8-6.7.2") ) flag++;

if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "NetworkManager-gnome");
}
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_4_NETWORKMANAGER-111104.NASL
    descriptionNetworkManager did not pin a certificate
    last seen2020-06-01
    modified2020-06-02
    plugin id75976
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/75976
    titleopenSUSE Security Update : NetworkManager (openSUSE-SU-2011:1273-1)
    code
    #%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from openSUSE Security Update NetworkManager-5373.
#
# The text description of this plugin is (C) SUSE LLC.
#

include("compat.inc");

if (description)
{
  script_id(75976);
  script_version("1.5");
  script_cvs_date("Date: 2019/10/25 13:36:41");

  script_cve_id("CVE-2006-7246", "CVE-2011-2176");

  script_name(english:"openSUSE Security Update : NetworkManager (openSUSE-SU-2011:1273-1)");
  script_summary(english:"Check for the NetworkManager-5373 patch");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote openSUSE host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"NetworkManager did not pin a certificate's subject to an ESSID. A
rogue access point could therefore be used to conduct MITM attacks by
using any other valid certificate issued by same CA as used in the
original network (CVE-2006-7246).

Please note that existing WPA2 Enterprise connections need to be
deleted and re-created to take advantage of the new security checks.

NetworkManager did not honor the PolicyKit auth_admin setting when
creating Ad-Hoc wireless networks (CVE-2011-2176)"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.novell.com/show_bug.cgi?id=574266"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.novell.com/show_bug.cgi?id=702016"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://lists.opensuse.org/opensuse-updates/2011-11/msg00025.html"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected NetworkManager packages."
  );
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:N");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:NetworkManager");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:NetworkManager-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:NetworkManager-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:NetworkManager-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:NetworkManager-glib");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:NetworkManager-glib-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:NetworkManager-gnome");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:NetworkManager-gnome-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:NetworkManager-gnome-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:NetworkManager-gnome-lang");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:NetworkManager-lang");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:wpa_supplicant");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:wpa_supplicant-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:wpa_supplicant-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:wpa_supplicant-gui");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:wpa_supplicant-gui-debuginfo");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:11.4");

  script_set_attribute(attribute:"patch_publication_date", value:"2011/11/04");
  script_set_attribute(attribute:"plugin_publication_date", value:"2014/06/13");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/SuSE/release");
if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
if (release !~ "^(SUSE11\.4)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "11.4", release);
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

ourarch = get_kb_item("Host/cpu");
if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);

flag = 0;

if ( rpm_check(release:"SUSE11.4", reference:"NetworkManager-0.8.2-15.28.1") ) flag++;
if ( rpm_check(release:"SUSE11.4", reference:"NetworkManager-debuginfo-0.8.2-15.28.1") ) flag++;
if ( rpm_check(release:"SUSE11.4", reference:"NetworkManager-debugsource-0.8.2-15.28.1") ) flag++;
if ( rpm_check(release:"SUSE11.4", reference:"NetworkManager-devel-0.8.2-15.28.1") ) flag++;
if ( rpm_check(release:"SUSE11.4", reference:"NetworkManager-glib-0.8.2-15.28.1") ) flag++;
if ( rpm_check(release:"SUSE11.4", reference:"NetworkManager-glib-debuginfo-0.8.2-15.28.1") ) flag++;
if ( rpm_check(release:"SUSE11.4", reference:"NetworkManager-gnome-0.8.2-9.12.1") ) flag++;
if ( rpm_check(release:"SUSE11.4", reference:"NetworkManager-gnome-debuginfo-0.8.2-9.12.1") ) flag++;
if ( rpm_check(release:"SUSE11.4", reference:"NetworkManager-gnome-debugsource-0.8.2-9.12.1") ) flag++;
if ( rpm_check(release:"SUSE11.4", reference:"NetworkManager-gnome-lang-0.8.2-9.12.1") ) flag++;
if ( rpm_check(release:"SUSE11.4", reference:"NetworkManager-lang-0.8.2-15.28.1") ) flag++;
if ( rpm_check(release:"SUSE11.4", reference:"wpa_supplicant-0.7.3-3.4.1") ) flag++;
if ( rpm_check(release:"SUSE11.4", reference:"wpa_supplicant-debuginfo-0.7.3-3.4.1") ) flag++;
if ( rpm_check(release:"SUSE11.4", reference:"wpa_supplicant-debugsource-0.7.3-3.4.1") ) flag++;
if ( rpm_check(release:"SUSE11.4", reference:"wpa_supplicant-gui-0.7.3-3.4.1") ) flag++;
if ( rpm_check(release:"SUSE11.4", reference:"wpa_supplicant-gui-debuginfo-0.7.3-3.4.1") ) flag++;

if (flag)
{
  if (report_verbosity > 0) security_note(port:0, extra:rpm_report_get());
  else security_note(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "NetworkManager / NetworkManager-devel / NetworkManager-glib / etc");
}
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_4_NETWORKMANAGER-GNOME-120110.NASL
    descriptionNetworkManager did not pin a certificate
    last seen2020-06-05
    modified2014-06-13
    plugin id75977
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/75977
    titleopenSUSE Security Update : NetworkManager-gnome (openSUSE-SU-2012:0101-1)
    code
    #%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from openSUSE Security Update NetworkManager-gnome-5627.
#
# The text description of this plugin is (C) SUSE LLC.
#

include("compat.inc");

if (description)
{
  script_id(75977);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");

  script_cve_id("CVE-2006-7246");

  script_name(english:"openSUSE Security Update : NetworkManager-gnome (openSUSE-SU-2012:0101-1)");
  script_summary(english:"Check for the NetworkManager-gnome-5627 patch");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote openSUSE host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"NetworkManager did not pin a certificate's subject to an ESSID. A
rogue access point could therefore be used to conduct MITM attacks by
using any other valid certificate issued by same CA as used in the
original network (CVE-2006-7246).

Please note that existing WPA2 Enterprise connections need to be
deleted and re-created to take advantage of the new security checks.

This is a re-release of the previous update to also enable the checks
for EAP-TLS."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.novell.com/show_bug.cgi?id=574266"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.novell.com/show_bug.cgi?id=732700"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://lists.opensuse.org/opensuse-updates/2012-01/msg00036.html"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected NetworkManager-gnome packages."
  );
  script_set_attribute(attribute:"risk_factor", value:"Medium");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:NetworkManager-gnome");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:NetworkManager-gnome-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:NetworkManager-gnome-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:NetworkManager-gnome-lang");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:11.4");

  script_set_attribute(attribute:"patch_publication_date", value:"2012/01/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2014/06/13");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/SuSE/release");
if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
if (release !~ "^(SUSE11\.4)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "11.4", release);
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

ourarch = get_kb_item("Host/cpu");
if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);

flag = 0;

if ( rpm_check(release:"SUSE11.4", reference:"NetworkManager-gnome-0.8.2-9.16.1") ) flag++;
if ( rpm_check(release:"SUSE11.4", reference:"NetworkManager-gnome-debuginfo-0.8.2-9.16.1") ) flag++;
if ( rpm_check(release:"SUSE11.4", reference:"NetworkManager-gnome-debugsource-0.8.2-9.16.1") ) flag++;
if ( rpm_check(release:"SUSE11.4", reference:"NetworkManager-gnome-lang-0.8.2-9.16.1") ) flag++;

if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "NetworkManager-gnome / NetworkManager-gnome-lang / etc");
}
  • NASL familySuSE Local Security Checks
    NASL idSUSE_NETWORKMANAGER-7957.NASL
    descriptionNetworkManager did not pin a certificate
    last seen2020-06-05
    modified2012-02-20
    plugin id58032
    published2012-02-20
    reporterThis script is Copyright (C) 2012-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/58032
    titleSuSE 10 Security Update : NetworkManager (ZYPP Patch Number 7957)
    code
    #%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The text description of this plugin is (C) Novell, Inc.
#

include("compat.inc");

if (description)
{
  script_id(58032);
  script_version ("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");

  script_cve_id("CVE-2006-7246");

  script_name(english:"SuSE 10 Security Update : NetworkManager (ZYPP Patch Number 7957)");
  script_summary(english:"Checks rpm output for the updated packages");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote SuSE 10 host is missing a security-related patch."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"NetworkManager did not pin a certificate's subject to an ESSID. A
rogue access point could therefore be used to conduct MITM attacks by
using any other valid certificate issued by same CA as used in the
original network. (CVE-2006-7246)

Please note that existing WPA2 Enterprise connections need to be
deleted and re-created to take advantage of the new security checks."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2006-7246.html"
  );
  script_set_attribute(attribute:"solution", value:"Apply ZYPP patch number 7957.");
  script_set_attribute(attribute:"risk_factor", value:"High");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:suse:suse_linux");

  script_set_attribute(attribute:"patch_publication_date", value:"2012/02/08");
  script_set_attribute(attribute:"plugin_publication_date", value:"2012/02/20");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2012-2020 Tenable Network Security, Inc.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");

  exit(0);
}


include("global_settings.inc");
include("rpm.inc");


if (!get_kb_item("Host/local_checks_enabled")) exit(0, "Local checks are not enabled.");
if (!get_kb_item("Host/SuSE/release")) exit(0, "The host is not running SuSE.");
if (!get_kb_item("Host/SuSE/rpm-list")) exit(1, "Could not obtain the list of installed packages.");

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) exit(1, "Failed to determine the architecture type.");
if (cpu >!< "x86_64" && cpu !~ "^i[3-6]86$") exit(1, "Local checks for SuSE 10 on the '"+cpu+"' architecture have not been implemented.");


flag = 0;
if (rpm_check(release:"SLED10", sp:4, reference:"NetworkManager-0.6.6-0.21.5")) flag++;
if (rpm_check(release:"SLED10", sp:4, reference:"NetworkManager-devel-0.6.6-0.21.5")) flag++;
if (rpm_check(release:"SLED10", sp:4, reference:"NetworkManager-glib-0.6.6-0.21.5")) flag++;
if (rpm_check(release:"SLED10", sp:4, reference:"NetworkManager-gnome-0.6.6-0.21.5")) flag++;
if (rpm_check(release:"SLED10", sp:4, reference:"wpa_supplicant-0.4.8-14.29.5")) flag++;
if (rpm_check(release:"SLES10", sp:4, reference:"NetworkManager-0.6.6-0.21.5")) flag++;
if (rpm_check(release:"SLES10", sp:4, reference:"NetworkManager-devel-0.6.6-0.21.5")) flag++;
if (rpm_check(release:"SLES10", sp:4, reference:"NetworkManager-glib-0.6.6-0.21.5")) flag++;
if (rpm_check(release:"SLES10", sp:4, reference:"NetworkManager-gnome-0.6.6-0.21.5")) flag++;
if (rpm_check(release:"SLES10", sp:4, reference:"wpa_supplicant-0.4.8-14.29.5")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
  else security_hole(0);
  exit(0);
}
else exit(0, "The host is not affected.");

References