[ GLSA 201206-08 ] Wicd: Multiple vulnerabilities

[GLSA]

Gentoo Linux Security Advisory

Title: Wicd: Multiple vulnerabilities (GLSA 201206-08)
Severity: high
Exploitable: local
Date: June 21, 2012
Bug(s): #401005, #411729
ID: 201206-08

Synopsis

Multiple vulnerabilities have been found in Wicd, the worst of
which might allow execution of arbitrary code as root.


Background

Wicd is an open source wired and wireless network manager for Linux.

Affected Packages

Package: net-misc/wicd
Vulnerable: < 1.7.2.1
Unaffected: >= 1.7.2.1
Architectures: All supported architectures


Description

Two vulnerabilities have been found in Wicd:

• Passwords and passphrases are written to /var/log/wicd
  (CVE-2012-0813).
  
• Input from the daemon's D-Bus interface is not properly sanitized
  (CVE-2012-2095).
  

Impact

A local attacker could gain privileges of the root user or obtain
sensitive information.


Workaround

There is no known workaround at this time.

Resolution

All Wicd users should upgrade to the latest version: