Description
nm-applet.conf in GNOME NetworkManager before 0.7.0.99 contains an incorrect deny setting, which allows local users to discover (1) network connection passwords and (2) pre-shared keys via calls to the GetSecrets method in the dbus request handler.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | network-manager | 0.6.5-1 | — |
| Debian 14 | network-manager-applet | 0.7.0.99-1 | — |
| Debian 13 | network-manager | 0.6.5-1 | — |
| Debian 13 | network-manager-applet | 0.7.0.99-1 | — |
| Debian 12 | network-manager | 0.6.5-1 | — |
| Debian 12 | network-manager-applet | 0.7.0.99-1 | — |
| Debian 5.0 | network-manager-applet | 0.6.6-4+lenny1 | DSA-1955-1 |
| Debian 4.0 | network-manager | 0.6.4-6+etch1 | DSA-1955-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | NetworkManager +4 | 1:0.7.0-4.el5_3 | RHSA-2009:0361 |
| RHEL 4 | NetworkManager +1 | 0.3.1-5.el4 | RHSA-2009:0362 |
Advisories 3
- RHSA-2009:0361 Red Hat Security Advisory: NetworkManager security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2009:0362 Red Hat Security Advisory: NetworkManager security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1955-1 network-manager network-manager-applet - information disclosure Debian Security (DSA / DLA) · Mar 9, 2026
References
- 1021910 vdb-entry
- USN-727-1 vendor-advisory
- USN-727-2 vendor-advisory
- networkmanager-dbus-info-disclosure(49062) vdb-entry
- 1021908 vdb-entry
- http://svn.gnome.org/viewvc/network-manager-applet?view=revision&revision=1207
- 33966 vdb-entry
- 1021911 vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=487722
- http://svn.gnome.org/viewvc/network-manager-applet/trunk/nm-applet.conf?r1=1133&r2=1207&pathrev=1207
- oval:org.mitre.oval:def:10828 vdb-entry signature
- 34067 third-party-advisory
- RHSA-2009:0362 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=487752
- DSA-1955 vendor-advisory
- SUSE-SR:2009:009 vendor-advisory
- SUSE-SA:2009:013 vendor-advisory
- RHSA-2009:0361 vendor-advisory
- 34177 third-party-advisory
- 34473 third-party-advisory