Read the docs
TI-2009-00345 Aliases CVE-2009-0365GHSA-hprr-xq95-m5m9

nm-applet.conf in GNOME NetworkManager before 0.7.0.99 contains an incorrect deny…

Priority LOW 23CWE-264Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Complete · None · None
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-264.

Summary

nm-applet.conf in GNOME NetworkManager before 0.7.0.99 contains an incorrect deny setting, which allows local users to discover (1) network connection passwords and (2) pre-shared keys via calls to the GetSecrets method in the dbus request handler.

Why it matters now

EPSS 0.01094 65th percentileScored 2026-11-07
Fix Fixed Red Hat: 2 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:o:ubuntu:ubuntu_linux:6.06:-:lts:*:*:*:*:*6.06VulnerableUbuntu
cpe:2.3:o:ubuntu:ubuntu_linux:7.10:*:*:*:*:*:*:*7.10VulnerableUbuntu
cpe:2.3:o:ubuntu:ubuntu_linux:8.04:-:lts:*:*:*:*:*8.04VulnerableUbuntu
cpe:2.3:o:ubuntu:ubuntu_linux:8.10:*:*:*:*:*:*:*8.10VulnerableUbuntu
  • cpe:2.3:o:ubuntu:ubuntu_linux:6.06:-:lts:*:*:*:*:* Versions 6.06 Vulnerable ·Ubuntu
  • cpe:2.3:o:ubuntu:ubuntu_linux:7.10:*:*:*:*:*:*:* Versions 7.10 Vulnerable ·Ubuntu
  • cpe:2.3:o:ubuntu:ubuntu_linux:8.04:-:lts:*:*:*:*:* Versions 8.04 Vulnerable ·Ubuntu
  • cpe:2.3:o:ubuntu:ubuntu_linux:8.10:*:*:*:*:*:*:* Versions 8.10 Vulnerable ·Ubuntu

Remediation

Red Hat 2 advisories

  • RHSA-2009:0362 Released 2009-03-25 · Red Hat rating Moderate
    NetworkManager security update
    • Red Hat Enterprise Linux AS version 4 NetworkManager-0.3.1-5.el4, NetworkManager-0.3.1-5.el4.i386, NetworkManager-0.3.1-5.el4.ia64 +5
    • Red Hat Enterprise Linux Desktop version 4 NetworkManager-0.3.1-5.el4, NetworkManager-0.3.1-5.el4.i386, NetworkManager-gnome-0.3.1-5.el4 +1
    • Red Hat Enterprise Linux ES version 4 NetworkManager-0.3.1-5.el4, NetworkManager-0.3.1-5.el4.i386, NetworkManager-0.3.1-5.el4.ia64 +3
    • Red Hat Enterprise Linux WS version 4 NetworkManager-0.3.1-5.el4, NetworkManager-0.3.1-5.el4.i386, NetworkManager-0.3.1-5.el4.ia64 +3
  • RHSA-2009:0361 Released 2009-03-25 · Red Hat rating Moderate
    NetworkManager security update
    • Red Hat Enterprise Linux (v. 5 server) NetworkManager-1:0.7.0-4.el5_3, NetworkManager-1:0.7.0-4.el5_3.i386, NetworkManager-1:0.7.0-4.el5_3.ia64 +17
    • Red Hat Enterprise Linux Desktop (v. 5 client) NetworkManager-1:0.7.0-4.el5_3, NetworkManager-1:0.7.0-4.el5_3.i386, NetworkManager-glib-1:0.7.0-4.el5_3 +3
    • Red Hat Enterprise Linux Desktop Workstation (v. 5 client) NetworkManager-1:0.7.0-4.el5_3, NetworkManager-devel-1:0.7.0-4.el5_3, NetworkManager-devel-1:0.7.0-4.el5_3.i386 +2

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux (v. 5 server)Fixed RHSA-2009:0361
Red Hat Enterprise Linux AS version 4Fixed RHSA-2009:0362
Red Hat Enterprise Linux Desktop (v. 5 client)Fixed RHSA-2009:0361
Red Hat Enterprise Linux Desktop Workstation (v. 5 client)Fixed RHSA-2009:0361
Red Hat Enterprise Linux Desktop version 4Fixed RHSA-2009:0362
Red Hat Enterprise Linux ES version 4Fixed RHSA-2009:0362
Red Hat Enterprise Linux WS version 4Fixed RHSA-2009:0362

Timeline

  1. 2026-10-02 Threatist record created from CVE-2009-0365
  2. 2026-10-03 Alias added: GHSA-hprr-xq95-m5m9

References

Advisory 7

Other 5

  • TI-2007-05153 Stack-based buffer overflow in the cons_options function in options.c in dhcpd in OpenBSD… CVSS 2.0HIGH 7.2
  • TI-2004-01032 Multiple vulnerabilities in the IGMP functionality for Linux kernel 2.4.22 to 2.4.28, and… CVSS 2.0HIGH 10.0
  • TI-2004-00896 Multiple buffer overflows in libXML 2.6.12 and 2.6.13 (libxml2), and possibly other… CVSS 2.0HIGH 10.0
  • TI-2004-00800 Buffer overflow in the QFILEPATHINFO request handler in Samba 3.0.x through 3.0.7 may… CVSS 2.0HIGH 10.0
  • TI-2004-00962 Buffer overflow in the exif_read_data function in PHP before 4.3.10 and PHP 5.x up to… CVSS 2.0HIGH 10.0
  • TI-2004-00806 Multiple integer overflows in xpdf 2.0 and 3.0, and other packages that use xpdf code… CVSS 2.0HIGH 10.0
See all 63 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences