A vulnerability has been found in GNOME applet for NetworkManager allowing local attackers to access the local filesystem.

Announced

2017-07-08

Revised

2017-08-06 (revision 2)

Access

local

Bugs

#613768

Advisory

https://security.gentoo.org/glsa/201707-09

Affected packages

Package	Arch	Vulnerable	Unaffected
gnome-extra/nm-applet	*	< 1.4.6-r1	>= 1.4.6-r1

Background

GNOME applet for NetworkManager is a GTK+ 3 front-end which works under Xorg environments with a systray.

Description

Frederic Bardy and Quentin Biguenet discovered that GNOME applet for NetworkManager incorrectly checked permissions when connecting to certain wireless networks.

Impact

A local attacker could bypass security restrictions at the login screen to access local files.

Workaround

There is no known workaround at this time.

Resolution

All GNOME applet for NetworkManager users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=gnome-extra/nm-applet-1.4.6-r1"

References

• CVE-2017-6590