Bug 782627 (CVE-2012-2736)

Summary:	CVE-2012-2736 NetworkManager: creating new WPA-secured wireless network results in insecure network being created instead
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	dcbw, gasmith, jan.public, jlieskov
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-08-22 15:56:58 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	782632

Description Vincent Danen 2012-01-18 00:07:07 UTC

A Debian bug report [1] indicated that certain versions of NetworkManager, when creating a wireless network (like a hotspot) with WPA/WPA2 security would result in an insecure network being created instead.

The following steps are outlined to reproduce (reported against network-manager-gnome 0.9.2.0-1 in Debian):

- Connect to a wired network.
- Click the network-manager-gnome icon, and select "Create New Wireless
  Network..."
- Type a network name.
- Select "WPA & WPA2 Personal".
- Click "Show password".
- Paste in a secure password (from pwgen -s 12).
- Click "Create".
- Observe that NetworkManager's icon for the network includes the lock
  icon indicating a secure network.
- Attempt to connect to the network from my N900.
- Observe that network icon shows lack of security.
- Observe that I can connect to the network and access the Internet
  through the network without providing the previously-specified
  password.

He also notes that creating a network using WEP results in a secured (via WEP) network instead of an open/unsecured network which is what is reported to happen when attempting to create a WPA-based network.

[1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=655972

Comment 1 Vincent Danen 2012-01-18 00:23:30 UTC

It looks like this is corrected in newer versions of NetworkManager due to the hotspot functionality (at least I am unable to reproduce this in Fedora 16).  When I create a new hotsport with WPA security, it starts but I'm unable to connect to it (my OS X laptop sees it as a device to connect to but asks for a WEP password, not WPA, and although it says it connects, I don't get an IP address in OS X).  If I change this to WEP in F16, then OS X sees it as an insecure network (no padlock).

Comment 3 Huzaifa S. Sidhpurwala 2012-06-15 04:57:24 UTC

This has been assigned CVE-2012-2736 as per: 

http://www.openwall.com/lists/oss-security/2012/06/15/2

Patch:

http://cgit.freedesktop.org/NetworkManager/NetworkManager/commit/?id=69247a00eacd00617acbf1dfcee8497437b8ad39

Note:
This seems to be a kernel bug, and the current solution is to disable adhoc/WPA networks in NetworkManager, untill the kernel bug is fixed.

Comment 6 Vincent Danen 2015-08-22 15:56:47 UTC

Statement:

Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.