Missing escaping of ESSID values in sysconfig of SUSE Linux Enterprise allows attackers controlling an access point to cause execute arbitrary code. Affected releases are sysconfig prior to 0.83.7-2.1.

This update for sysconfig contains the following fixes :

  - sysconfig hook script for NetworkManager did not     properly quote shell meta characters when processing     ESSIDs. Specially crafted network names could therefore     lead to execution of shell code (CVE-2011-4182).

  - Explicitly disabled posix mode in all bash scripts as we     are using several features not supported in posix mode     (bnc#739338).

  - Fixed ipv6 dad / link ready wait time calculation (1/10     of the specified time were used), replaced useless up     flag check loop with link_ready_wait to avoid send     errors from dhclient6 and cleaned up link / dad wait     verify flag after status update (bnc#697929).

- Fixed to quote config / interface variables in     ifservices script and cleaned up content of the ESSID     which gets appended to them by NetworkManager dispatcher     hook (bnc#735394, CVE-2011-4182). Fixed also to return     proper exit code 0 in NM dispatcher hooks.

  - Changed to call ip addr flush in ifdown, but after ip     link set down as it does not cause ipv6 sysctl tree side     effects then at least with more recent kernels     (bnc#580018,bnc#559170).

  - Explicitly disabled posix mode in all bash scripts as we     are using several features not supported in posix mode     (bnc#739338).

  - Fixed ipv6 dad / link ready wait time calculation (1/10     of the specified time) and replaced useless up flag     check loop with link_ready_wait to avoid send errors     from dhclient6 (bnc#697929).

  - Added to require vlan, bridge-utils and tunctl packages     via spec, that are often required in base networking     configurations and are missed otherwise in 2nd     installation stage, that may be unable to install them     for some reason (bnc#733118).

  - Added X-Systemd-RemainAfterExit: true LSB header     (bnc#727771)

  - Do not suggest dhcp6c client from dropped dhcpv6 package     in ifup-dhcp, marked dhcp6c as deprecated in     network/dhcp and changed to use dhclient6 as first     choice (bnc#734723).

The following bug has been fixed :

  - sysconfig hook script for NetworkManager did not     properly quote shell meta characters when processing     ESSIDs. Specially crafted network names could have     therefore lead to execution of shell code.
    (CVE-2011-4182)

sysconfig hook script for NetworkManager did not properly quote shell meta characters when processing ESSIDs. Specially crafted network names could have therefore lead to execution of shell code.
(CVE-2011-4182)

In addition, the following non-security bugs were fixed :

  - 580018: ip addr flush $ifname causes vanishing     /proc/sys/net/ipv6/conf/$ifname

  - 697929: ipv6, rcnetwork returns before dad completed

ID	Name	Product	Family	Severity
76032	openSUSE Security Update : sysconfig (openSUSE-SU-2012:0242-1)	Nessus	SuSE Local Security Checks	high
75753	openSUSE Security Update : sysconfig (openSUSE-SU-2012:0242-1)	Nessus	SuSE Local Security Checks	high
74794	openSUSE Security Update : sysconfig (openSUSE-2012-74)	Nessus	SuSE Local Security Checks	high
57872	SuSE 10 Security Update : sysconfig (ZYPP Patch Number 7892)	Nessus	SuSE Local Security Checks	high
57597	SuSE 11.1 Security Update : sysconfig (SAT Patch Number 5618)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2011-4182

high

Tenable Plugins

high

high

high

high

high