CVE-2009-0365 Information disclosure in n/a

Medium 4.6 Published 5 Mar 2009 Updated 7 Aug 2024

Local users can discover network connection passwords and pre-shared keys via incorrect D-Bus permissions in GNOME NetworkManager.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2009-0365?

CVE-2009-0365 is a medium-severity vulnerability in Ubuntu Ubuntu Linux, published on 5 Mar 2009. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

nm-applet.conf in GNOME NetworkManager before 0.7.0.99 contains an incorrect deny setting, which allows local users to discover (1) network connection passwords and (2) pre-shared keys via calls to the GetSecrets method in the dbus request handler.

Weakness: CWE-264

Which versions are affected by CVE-2009-0365?

It affects 1 product.

Linux distribution packages (12)

`NetworkManager` Red Hat:enterprise_linux:4::as	All versions	`0:0.3.1-5.el4`
`NetworkManager-debuginfo` Red Hat:enterprise_linux:4::as	All versions	`0:0.3.1-5.el4`
`NetworkManager-gnome` Red Hat:enterprise_linux:4::as	All versions	`0:0.3.1-5.el4`
`NetworkManager` Red Hat:enterprise_linux:4::desktop	All versions	`0:0.3.1-5.el4`
`NetworkManager-debuginfo` Red Hat:enterprise_linux:4::desktop	All versions	`0:0.3.1-5.el4`
`NetworkManager-gnome` Red Hat:enterprise_linux:4::desktop	All versions	`0:0.3.1-5.el4`
`NetworkManager` Red Hat:enterprise_linux:4::es	All versions	`0:0.3.1-5.el4`
`NetworkManager-debuginfo` Red Hat:enterprise_linux:4::es	All versions	`0:0.3.1-5.el4`
`NetworkManager-gnome` Red Hat:enterprise_linux:4::es	All versions	`0:0.3.1-5.el4`
`NetworkManager` Red Hat:enterprise_linux:4::ws	All versions	`0:0.3.1-5.el4`
`NetworkManager-debuginfo` Red Hat:enterprise_linux:4::ws	All versions	`0:0.3.1-5.el4`
`NetworkManager-gnome` Red Hat:enterprise_linux:4::ws	All versions	`0:0.3.1-5.el4`

Products include Ubuntu Ubuntu Linux.

How do I fix CVE-2009-0365?

Upgrade to a fixed version.

Is CVE-2009-0365 being exploited?

There is no known exploitation of CVE-2009-0365 in the wild and no public exploit code.

All Ubuntu Ubuntu Linux vulnerabilities

Sources

Also known as DEBIAN-CVE-2009-0365, DSA-1955-1, GHSA-hprr-xq95-m5m9, RHSA-2009:0362.