Bug 756418 (CVE-2006-7246)

Summary:	CVE-2006-7246 NetworkManager, wpa_supplicant (WPA-Enterprise): Verify that the certificate is from trusted CA and matches the specified subject
Product:	[Other] Security Response	Reporter:	Jan Lieskovsky <jlieskov>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED UPSTREAM	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	bressers, dcbw
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-06-13 16:34:09 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	756419

Description Jan Lieskovsky 2011-11-23 14:05:27 UTC

A security flaw was found in the way NetworkManager, a network connection manager, and wpa_supplicant, a WPA/WPA2/IEEE 802.1X supplicant, performed certificate's subject against ESSID verification, when 802.11X (WPA Enterprise) authentication scheme was used. A remote attacker, with the privilege to change a certificate on an access point, could use this flaw to conduct MITM attacks via other, valid certificate, issued by the same certification authority (CA) as that one, for the original network. In the case of password based authentication (PEAP or EAP-TTLS) a remote attacker could use this flaw to obtain and potentially discover the plaintext version of the password hashes of the victims.

References: 
[1] https://bugzilla.novell.com/show_bug.cgi?id=574266
[2] http://www.openwall.com/lists/oss-security/2010/04/22/2
[3] http://www.suse.de/~lnussel/The_Evil_Twin_problem_with_WPA2-Enterprise_v1.1.pdf
[4] http://lwn.net/Articles/468868/

Upstream bug reports:
[5] https://bugzilla.gnome.org/show_bug.cgi?id=341323
[6] https://bugzilla.gnome.org/show_bug.cgi?id=621484

Comment 1 Huzaifa S. Sidhpurwala 2011-12-07 05:32:24 UTC

Upstream patchset:

http://cgit.freedesktop.org/NetworkManager/NetworkManager/commit/?id=ca968105daa7bb9e2fd1d64c2d2270f110f984ba
http://cgit.freedesktop.org/NetworkManager/NetworkManager/commit/?id=0b8097a26a59ef0b2c0ab78f9ec3656e5681404b
http://cgit.freedesktop.org/NetworkManager/NetworkManager/commit/?id=4f38f02add9aa0e311f1ddb605b1aa0224ad057e

Comment 2 Huzaifa S. Sidhpurwala 2011-12-08 08:00:01 UTC

wpa_supplicant upstream patch:

http://w1.fi/gitweb/gitweb.cgi?p=hostap.git;a=commit;h=00468b4650998144f794762206c695c962c54734

Comment 4 Jan Lieskovsky 2012-08-24 10:44:14 UTC

Some of the proposed GUI patches has been reported to be able to cause (post patching) resurrection of CVE-2006-7246 (wpa_supplicant to not to completely check certificates again):

https://bugzilla.novell.com/show_bug.cgi?id=777228

Comment 7 Josh Bressers 2014-06-13 16:34:09 UTC

We expect this to be fixed upstream in a future release.

Comment 8 Fedora Update System 2016-04-02 15:55:01 UTC

NetworkManager-1.2.0-0.8.beta3.fc24, NetworkManager-fortisslvpn-1.2.0-0.4.beta3.fc24, NetworkManager-libreswan-1.2.0-0.4.beta3.fc24, NetworkManager-openconnect-1.2.0-0.3.beta3.fc24, NetworkManager-openvpn-1.2.0-0.3.beta3.fc24, NetworkManager-pptp-1.2.0-0.3.beta3.fc24, NetworkManager-strongswan-1.3.1-3.20160330libnm.fc24, NetworkManager-vpnc-1.2.0-0.4.beta3.fc24, network-manager-applet-1.2.0-0.3.beta3.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.