Vulnerabilities > CVE-2009-0365 - Permissions, Privileges, and Access Controls vulnerability in Ubuntu Linux

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Fedora Security Advisory 2009-2419.
#

include("compat.inc");

if (description)
{
  script_id(36291);
  script_version ("1.18");
  script_cvs_date("Date: 2019/08/02 13:32:29");

  script_cve_id("CVE-2009-0365", "CVE-2009-0578");
  script_bugtraq_id(33966);
  script_xref(name:"FEDORA", value:"2009-2419");

  script_name(english:"Fedora 10 : NetworkManager-openconnect-0.7.0.99-1.fc10 / knetworkmanager-0.7-0.8.20080926svn.fc10 / etc (2009-2419)");
  script_summary(english:"Checks rpm output for the updated packages.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Fedora host is missing one or more security updates."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"The remote Fedora host is missing one or more security updates :

NetworkManager-0.7.0.99-1.fc10 :

  - Wed Mar 4 2009 Dan Williams <dcbw at redhat.com> -
    1:0.7.0.99-1

    - nm: make default wired 'Auto ethX' connection
      modifiable if an enabled system settings plugin
      supports modifying connections (rh #485555)

  - nm: manpage fixes (rh #447233)

    - nm: CVE-2009-0365 - GetSecrets disclosure

    - applet: CVE-2009-0578 - local users can modify the
      connection settings

    - applet: fix inability to choose WPA Ad-Hoc networks
      from the menu

    - ifcfg-rh: add read-only support for WPA-PSK
      connections

    - ifcfg-rh: revert fix for #441453 (honor localhost)
      until gdm gets fixed

    - Wed Feb 25 2009 Dan Williams <dcbw at redhat.com> -
      1:0.7.0.98-1.git20090225

    - Fix getting secrets for system connections (rh
      #486696)

    - More compatible modem autodetection

    - Better handle minimal ifcfg files

    - Mon Feb 23 2009 Fedora Release Engineering <rel-eng at
      lists.fedoraproject.org> - 1:0.7.0.97-6.git20090220

    - Rebuilt for
      https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild

    - Fri Feb 20 2009 Dan Williams <dcbw at redhat.com> -
      1:0.7.0.97-5.git20090220

    - Use IFF_LOWER_UP for carrier detect instead of
      IFF_RUNNING

    - Add small delay before probing cdc-acm driven mobile
      broadband devices

    - Thu Feb 19 2009 Dan Williams <dcbw at redhat.com> -
      1:0.7.0.97-4.git20090219

    - Fix PEAP version selection in the applet (rh #468844)

    - Match hostname behavior to 'network' service when
      hostname is localhost (rh #441453)

    - Thu Feb 19 2009 Dan Williams <dcbw at redhat.com> -
      1:0.7.0.97-2

    - Fix 'noreplace' for nm-system-settings.conf

    - Wed Feb 18 2009 Dan Williams <dcbw at redhat.com> -
      1:0.7.0.97-1

    - Update to 0.7.1rc1

    - nm: support for Huawei E160G mobile broadband devices
      (rh #466177)

    - nm: fix misleading routing error message (rh #477916)

    - nm: fix issues with 32-character SSIDs (rh #485312)

    - nm: allow root to activate user connections

    - nm: automatic modem detection with udev-extras

    - nm: massive manpage rewrite

    - applet: fix crash when showing the CA certificate
      ignore dialog a second time

    - applet: clear keyring items when deleting a connection

    - applet: fix max signal strength calculation in menu
      (rh #475123)

    - applet: fix VPN export (rh #480496)

    - Sat Feb 7 2009 Dan Williams <dcbw at redhat.com> -
      1:0.7.0-2.git20090207

    - applet: fix blank VPN connection message bubbles

    - applet: better handling of VPN routing on update

    - applet: silence pointless warning (rh #484136)

    - applet: desensitize devices in the menu until they are
      ready (rh #483879)

    - nm: Expose WINS servers in the IP4Config over D-Bus

    - nm: Better handling of GSM Mobile Broadband modem
      initialization

    - nm: Handle DHCP Classless Static Routes (RFC 3442)

    - nm: Fix Mobile Broadband and PPPoE to always use
      'noauth'

    - nm: Better compatibility with older dual-SSID AP
      configurations (rh #445369)

    - nm: Mark nm-system-settings.conf as %config (rh
      #465633)

    - nm-tool: Show VPN connection information

    - ifcfg-rh: Silence message about ignoring loopback
      config (rh #484060)

    - ifcfg-rh: Fix issue with wrong gateway for system
      connections (rh #476089)

    - Fri Jan 2 2009 Dan Williams <dcbw at redhat.com> -
      1:0.7.0-1.git20090102

[plus 32 lines in the Changelog]

knetworkmanager-0.7-0.8.20080926svn.fc10 :

  - Tue Mar 3 2009 Dan Williams <dcbw at redhat.com> -
    0.7-0.8.20080926svn

    - don't send blank passwords in settings (rh #486877)

NetworkManager-vpnc-0.7.0.99-1.fc10 :

  - Thu Mar 5 2009 Dan Williams <dcbw at redhat.com>
    1:0.7.0.99-1

    - Update to 0.7.1rc3

    - Mon Feb 23 2009 Fedora Release Engineering <rel-eng at
      lists.fedoraproject.org> - 1:0.7.0.97-2

    - Rebuilt for
      https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild

    - Thu Feb 19 2009 Dan Williams <dcbw at redhat.com>
      1:0.7.0.97-1

    - Update to 0.7.1rc1

    - Handle import/export of 'EnableNat', 'DHGroup',
      'SaveUserPassword', and 'EnableLocalLAN'

    - Sat Jan 3 2009 Dan Williams <dcbw at redhat.com>
      1:0.7.0-1

    - Rebuild for updated NetworkManager

    - Better handling of passwords that shouldn't be saved

    - Fix some specfile issues (rh #477151)

    - Fri Nov 21 2008 Dan Williams <dcbw at redhat.com>
      1:0.7.0-0.11.svn4326

    - Rebuild for updated NetworkManager

    - Tue Nov 18 2008 Dan Williams <dcbw at redhat.com>
      1:0.7.0-0.11.svn4296

    - Rebuild for updated NetworkManager

    - Mon Nov 17 2008 Dan Williams <dcbw at redhat.com>
      1:0.7.0-0.11.svn4293

    - Ensure errors are shown when connection fails (rh
      #331141)

    - Fix failures to ask for passwords on connect (rh
      #429287)

    - Fix routing when concentrator specifies routes (rh
      #449283)

    - Pull in upstream support for tokens and not saving
      passwords

NetworkManager-openconnect-0.7.0.99-1.fc10 :

  - Bug #487722 - CVE-2009-0365 NetworkManager: GetSecrets
    disclosure

  - Bug #487752 - CVE-2009-0578 NetworkManager: local users
    can modify the connection settings

NetworkManager-openvpn-0.7.0.99-1.fc10 :

  - Thu Mar 5 2009 Dan Williams <dcbw at redhat.com>
    1:0.7.0.99-1

    - Update to 0.7.1rc3

    - Mon Feb 23 2009 Fedora Release Engineering <rel-eng at
      lists.fedoraproject.org> - 1:0.7.0.97-2

    - Rebuilt for
      https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild

    - Thu Feb 19 2009 Dan Williams <dcbw at redhat.com>
      1:0.7.0.97-1

    - Update to 0.7.1rc1

    - Handle HMAC Authentication (--auth)

    - Handle TAP device subnet masks correctly

    - Don't segfault if the connection type is invalid

    - Sat Jan 3 2009 Dan Williams <dcbw at redhat.com>
      1:0.7.0-18.svn11

    - Rebuild for updated NetworkManager

    - Fix some specfile issues (rh #477149)

    - Sat Dec 20 2008 Christoph Hoger <choeger at
      cs.tu-berlin.de> 0.7.0-17.svn4326

    - removed libpng-devel from BuildRequires, added
      /usr/share/gnome-vpn-properties/openvpn/ (rh #477149)

    - Fri Nov 21 2008 Dan Williams <dcbw at redhat.com>
      1:0.7.0-16.svn4326

    - Rebuild for updated NetworkManager

NetworkManager-pptp-0.7.0.99-1.fc10 :

  - Thu Mar 5 2009 Dan Williams <dcbw at redhat.com>
    1:0.7.0.99-1

    - Update to 0.7.1rc3

    - Mon Feb 23 2009 Fedora Release Engineering <rel-eng at
      lists.fedoraproject.org> - 1:0.7.0.97-2

    - Rebuilt for
      https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild

    - Thu Feb 19 2009 Dan Williams <dcbw at redhat.com>
      1:0.7.0.97-1

    - Update to 0.7.1rc1

    - Set a reasonable MTU

    - Ensure 'noauth' is used

    - Fix domain-based logins

    - Fix saving MPPE values in connection editor

    - Sat Jan 3 2009 Dan Williams <dcbw at redhat.com>
      1:0.7.0-1.svn16

    - Rebuild for updated NetworkManager

    - Fix some specfile issues (rh #477153)

    - Allow the EAP authentication method

    - Fri Nov 21 2008 Dan Williams <dcbw at redhat.com>
      1:0.7.0-12.svn4326

    - Rebuild for updated NetworkManager

Note that Tenable Network Security has extracted the preceding
description block directly from the Fedora security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.redhat.com/show_bug.cgi?id=487722"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.redhat.com/show_bug.cgi?id=487752"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild"
  );
  # https://lists.fedoraproject.org/pipermail/package-announce/2009-March/020995.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?eb0cdaaf"
  );
  # https://lists.fedoraproject.org/pipermail/package-announce/2009-March/020996.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?5ebfe1ec"
  );
  # https://lists.fedoraproject.org/pipermail/package-announce/2009-March/020997.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?2a7d06f9"
  );
  # https://lists.fedoraproject.org/pipermail/package-announce/2009-March/020998.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?bfaaf6c0"
  );
  # https://lists.fedoraproject.org/pipermail/package-announce/2009-March/020999.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?5645c4cc"
  );
  # https://lists.fedoraproject.org/pipermail/package-announce/2009-March/021000.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?be814122"
  );
  script_set_attribute(attribute:"solution", value:"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
  script_set_attribute(attribute:"canvas_package", value:'CANVAS');
  script_cwe_id(264);

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:NetworkManager");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:NetworkManager-openconnect");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:NetworkManager-openvpn");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:NetworkManager-pptp");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:NetworkManager-vpnc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:knetworkmanager");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:10");

  script_set_attribute(attribute:"vuln_publication_date", value:"2009/03/04");
  script_set_attribute(attribute:"patch_publication_date", value:"2009/03/08");
  script_set_attribute(attribute:"plugin_publication_date", value:"2009/04/23");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Fedora Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
os_ver = os_ver[1];
if (! ereg(pattern:"^10([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 10.x", "Fedora " + os_ver);

if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);

flag = 0;
if (rpm_check(release:"FC10", reference:"NetworkManager-0.7.0.99-1.fc10")) flag++;
if (rpm_check(release:"FC10", reference:"NetworkManager-openconnect-0.7.0.99-1.fc10")) flag++;
if (rpm_check(release:"FC10", reference:"NetworkManager-openvpn-0.7.0.99-1.fc10")) flag++;
if (rpm_check(release:"FC10", reference:"NetworkManager-pptp-0.7.0.99-1.fc10")) flag++;
if (rpm_check(release:"FC10", reference:"NetworkManager-vpnc-0.7.0.99-1.fc10")) flag++;
if (rpm_check(release:"FC10", reference:"knetworkmanager-0.7-0.8.20080926svn.fc10")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "NetworkManager / NetworkManager-openconnect / etc");
}

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The text description of this plugin is (C) Novell, Inc.
#

include("compat.inc");

if (description)
{
  script_id(41470);
  script_version ("1.11");
  script_cvs_date("Date: 2019/10/25 13:36:36");

  script_cve_id("CVE-2009-0365", "CVE-2009-0578");

  script_name(english:"SuSE 10 Security Update : NetworkManager-gnome (ZYPP Patch Number 6028)");
  script_summary(english:"Checks rpm output for the updated package");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote SuSE 10 host is missing a security-related patch."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"The NetworkManager configuration was too permissive and allowed any
user to read secrets (CVE-2009-0365) or manipulate the configuration
of other users. (CVE-2009-0578)"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2009-0365.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2009-0578.html"
  );
  script_set_attribute(attribute:"solution", value:"Apply ZYPP patch number 6028.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:C/A:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
  script_set_attribute(attribute:"canvas_package", value:'CANVAS');
  script_cwe_id(264);

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:suse:suse_linux");

  script_set_attribute(attribute:"patch_publication_date", value:"2009/02/26");
  script_set_attribute(attribute:"plugin_publication_date", value:"2009/09/24");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2009-2019 Tenable Network Security, Inc.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");

  exit(0);
}


include("global_settings.inc");
include("rpm.inc");


if (!get_kb_item("Host/local_checks_enabled")) exit(0, "Local checks are not enabled.");
if (!get_kb_item("Host/SuSE/release")) exit(0, "The host is not running SuSE.");
if (!get_kb_item("Host/SuSE/rpm-list")) exit(1, "Could not obtain the list of installed packages.");

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) exit(1, "Failed to determine the architecture type.");
if (cpu >!< "x86_64" && cpu !~ "^i[3-6]86$") exit(1, "Local checks for SuSE 10 on the '"+cpu+"' architecture have not been implemented.");


flag = 0;
if (rpm_check(release:"SLED10", sp:2, reference:"NetworkManager-gnome-0.6.6-0.14")) flag++;
if (rpm_check(release:"SLES10", sp:2, reference:"NetworkManager-gnome-0.6.6-0.14")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else exit(0, "The host is not affected.");

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from openSUSE Security Update NetworkManager-kde-565.
#
# The text description of this plugin is (C) SUSE LLC.
#

include("compat.inc");

if (description)
{
  script_id(40179);
  script_version("1.11");
  script_cvs_date("Date: 2019/10/25 13:36:34");

  script_cve_id("CVE-2009-0365");

  script_name(english:"openSUSE Security Update : NetworkManager-kde (NetworkManager-kde-565)");
  script_summary(english:"Check for the NetworkManager-kde-565 patch");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote openSUSE host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"The knetworkmanager configuration was too permissive and allowed any
user to read secrets (CVE-2009-0365)."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.novell.com/show_bug.cgi?id=479563"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected NetworkManager-kde packages."
  );
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:N/A:N");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
  script_set_attribute(attribute:"canvas_package", value:'CANVAS');
  script_cwe_id(264);

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:NetworkManager-kde");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:NetworkManager-kde-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:NetworkManager-openvpn-kde");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:NetworkManager-vpnc-kde");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:11.1");

  script_set_attribute(attribute:"patch_publication_date", value:"2009/02/26");
  script_set_attribute(attribute:"plugin_publication_date", value:"2009/07/21");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2009-2019 Tenable Network Security, Inc.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/SuSE/release");
if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
if (release !~ "^(SUSE11\.1)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "11.1", release);
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

ourarch = get_kb_item("Host/cpu");
if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);

flag = 0;

if ( rpm_check(release:"SUSE11.1", reference:"NetworkManager-kde-0.7r848570-23.2.1") ) flag++;
if ( rpm_check(release:"SUSE11.1", reference:"NetworkManager-kde-devel-0.7r848570-23.2.1") ) flag++;
if ( rpm_check(release:"SUSE11.1", reference:"NetworkManager-openvpn-kde-0.7r848570-23.2.1") ) flag++;
if ( rpm_check(release:"SUSE11.1", reference:"NetworkManager-vpnc-kde-0.7r848570-23.2.1") ) flag++;

if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "NetworkManager-kde / NetworkManager-kde-devel / etc");
}

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from openSUSE Security Update NetworkManager-gnome-563.
#
# The text description of this plugin is (C) SUSE LLC.
#

include("compat.inc");

if (description)
{
  script_id(39897);
  script_version("1.11");
  script_cvs_date("Date: 2019/10/25 13:36:33");

  script_cve_id("CVE-2009-0365", "CVE-2009-0578");

  script_name(english:"openSUSE Security Update : NetworkManager-gnome (NetworkManager-gnome-563)");
  script_summary(english:"Check for the NetworkManager-gnome-563 patch");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote openSUSE host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"The NetworkManager configuration was too permissive and allowed any
user to read secrets (CVE-2009-0365) or manipulate the configuration
of other users (CVE-2009-0578)."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.novell.com/show_bug.cgi?id=478080"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected NetworkManager-gnome package."
  );
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:C/A:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
  script_set_attribute(attribute:"canvas_package", value:'CANVAS');
  script_cwe_id(264);

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:NetworkManager-gnome");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:11.0");

  script_set_attribute(attribute:"patch_publication_date", value:"2009/02/26");
  script_set_attribute(attribute:"plugin_publication_date", value:"2009/07/21");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2009-2019 Tenable Network Security, Inc.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/SuSE/release");
if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
if (release !~ "^(SUSE11\.0)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "11.0", release);
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

ourarch = get_kb_item("Host/cpu");
if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);

flag = 0;

if ( rpm_check(release:"SUSE11.0", reference:"NetworkManager-gnome-0.7.0.r729-7.4") ) flag++;

if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "NetworkManager-gnome");
}

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Debian Security Advisory DSA-1955. The text 
# itself is copyright (C) Software in the Public Interest, Inc.
#

include("compat.inc");

if (description)
{
  script_id(44820);
  script_version("1.11");
  script_cvs_date("Date: 2019/08/02 13:32:22");

  script_cve_id("CVE-2009-0365");
  script_bugtraq_id(33966);
  script_xref(name:"DSA", value:"1955");

  script_name(english:"Debian DSA-1955-1 : network-manager/network-manager-applet - information disclosure");
  script_summary(english:"Checks dpkg output for the updated package");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Debian host is missing a security-related update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"It was discovered that network-manager-applet, a network management
framework, lacks some dbus restriction rules, which allows local users
to obtain sensitive information.

If you have locally modified the /etc/dbus-1/system.d/nm-applet.conf
file, then please make sure that you merge the changes from this fix
when asked during upgrade."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=519801"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.debian.org/security/2009/dsa-1955"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"Upgrade the network-manager and network-manager-applet packages
accordingly.

For the oldstable distribution (etch), this problem has been fixed in
version 0.6.4-6+etch1 of network-manager.

For the stable distribution (lenny), this problem has been fixed in
version 0.6.6-4+lenny1 of network-manager-applet."
  );
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
  script_set_attribute(attribute:"canvas_package", value:'CANVAS');
  script_cwe_id(264);

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:network-manager-applet");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:4.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:5.0");

  script_set_attribute(attribute:"patch_publication_date", value:"2009/12/16");
  script_set_attribute(attribute:"plugin_publication_date", value:"2010/02/24");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Debian Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}


include("audit.inc");
include("debian_package.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;
if (deb_check(release:"4.0", prefix:"libnm-glib-dev", reference:"0.6.4-6+etch1")) flag++;
if (deb_check(release:"4.0", prefix:"libnm-glib0", reference:"0.6.4-6+etch1")) flag++;
if (deb_check(release:"4.0", prefix:"libnm-util-dev", reference:"0.6.4-6+etch1")) flag++;
if (deb_check(release:"4.0", prefix:"libnm-util0", reference:"0.6.4-6+etch1")) flag++;
if (deb_check(release:"4.0", prefix:"network-manager", reference:"0.6.4-6+etch1")) flag++;
if (deb_check(release:"4.0", prefix:"network-manager-dev", reference:"0.6.4-6+etch1")) flag++;
if (deb_check(release:"4.0", prefix:"network-manager-gnome", reference:"0.6.4-6+etch1")) flag++;
if (deb_check(release:"5.0", prefix:"network-manager-gnome", reference:"0.6.6-4+lenny1")) flag++;

if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());
  else security_warning(0);
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");