Red Hat Bugzilla – Bug 756418
CVE-2006-7246 NetworkManager, wpa_supplicant (WPA-Enterprise): Verify that the certificate is from trusted CA and matches the specified subject
Last modified: 2016-04-02 11:55:01 EDT
A security flaw was found in the way NetworkManager, a network connection manager, and wpa_supplicant, a WPA/WPA2/IEEE 802.1X supplicant, performed certificate's subject against ESSID verification, when 802.11X (WPA Enterprise) authentication scheme was used. A remote attacker, with the privilege to change a certificate on an access point, could use this flaw to conduct MITM attacks via other, valid certificate, issued by the same certification authority (CA) as that one, for the original network. In the case of password based authentication (PEAP or EAP-TTLS) a remote attacker could use this flaw to obtain and potentially discover the plaintext version of the password hashes of the victims. References: [1] https://bugzilla.novell.com/show_bug.cgi?id=574266 [2] http://www.openwall.com/lists/oss-security/2010/04/22/2 [3] http://www.suse.de/~lnussel/The_Evil_Twin_problem_with_WPA2-Enterprise_v1.1.pdf [4] http://lwn.net/Articles/468868/ Upstream bug reports: [5] https://bugzilla.gnome.org/show_bug.cgi?id=341323 [6] https://bugzilla.gnome.org/show_bug.cgi?id=621484
Upstream patchset: http://cgit.freedesktop.org/NetworkManager/NetworkManager/commit/?id=ca968105daa7bb9e2fd1d64c2d2270f110f984ba http://cgit.freedesktop.org/NetworkManager/NetworkManager/commit/?id=0b8097a26a59ef0b2c0ab78f9ec3656e5681404b http://cgit.freedesktop.org/NetworkManager/NetworkManager/commit/?id=4f38f02add9aa0e311f1ddb605b1aa0224ad057e
wpa_supplicant upstream patch: http://w1.fi/gitweb/gitweb.cgi?p=hostap.git;a=commit;h=00468b4650998144f794762206c695c962c54734
Some of the proposed GUI patches has been reported to be able to cause (post patching) resurrection of CVE-2006-7246 (wpa_supplicant to not to completely check certificates again): https://bugzilla.novell.com/show_bug.cgi?id=777228
We expect this to be fixed upstream in a future release.
NetworkManager-1.2.0-0.8.beta3.fc24, NetworkManager-fortisslvpn-1.2.0-0.4.beta3.fc24, NetworkManager-libreswan-1.2.0-0.4.beta3.fc24, NetworkManager-openconnect-1.2.0-0.3.beta3.fc24, NetworkManager-openvpn-1.2.0-0.3.beta3.fc24, NetworkManager-pptp-1.2.0-0.3.beta3.fc24, NetworkManager-strongswan-1.3.1-3.20160330libnm.fc24, NetworkManager-vpnc-1.2.0-0.4.beta3.fc24, network-manager-applet-1.2.0-0.3.beta3.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.