Bug 756418 (CVE-2006-7246) - CVE-2006-7246 NetworkManager, wpa_supplicant (WPA-Enterprise): Verify that the certificate is from trusted CA and matches the specified subject
Summary: CVE-2006-7246 NetworkManager, wpa_supplicant (WPA-Enterprise): Verify that th...
Keywords:
Status: CLOSED UPSTREAM
Alias: CVE-2006-7246
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 756419
TreeView+ depends on / blocked
 
Reported: 2011-11-23 14:05 UTC by Jan Lieskovsky
Modified: 2019-09-29 12:48 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2014-06-13 16:34:09 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Novell 777228 None None None 2012-08-24 10:44:14 UTC

Description Jan Lieskovsky 2011-11-23 14:05:27 UTC
A security flaw was found in the way NetworkManager, a network connection manager, and wpa_supplicant, a WPA/WPA2/IEEE 802.1X supplicant, performed certificate's subject against ESSID verification, when 802.11X (WPA Enterprise) authentication scheme was used. A remote attacker, with the privilege to change a certificate on an access point, could use this flaw to conduct MITM attacks via other, valid certificate, issued by the same certification authority (CA) as that one, for the original network. In the case of password based authentication (PEAP or EAP-TTLS) a remote attacker could use this flaw to obtain and potentially discover the plaintext version of the password hashes of the victims.

References: 
[1] https://bugzilla.novell.com/show_bug.cgi?id=574266
[2] http://www.openwall.com/lists/oss-security/2010/04/22/2
[3] http://www.suse.de/~lnussel/The_Evil_Twin_problem_with_WPA2-Enterprise_v1.1.pdf
[4] http://lwn.net/Articles/468868/

Upstream bug reports:
[5] https://bugzilla.gnome.org/show_bug.cgi?id=341323
[6] https://bugzilla.gnome.org/show_bug.cgi?id=621484

Comment 2 Huzaifa S. Sidhpurwala 2011-12-08 08:00:01 UTC
wpa_supplicant upstream patch:

http://w1.fi/gitweb/gitweb.cgi?p=hostap.git;a=commit;h=00468b4650998144f794762206c695c962c54734

Comment 4 Jan Lieskovsky 2012-08-24 10:44:14 UTC
Some of the proposed GUI patches has been reported to be able to cause (post patching) resurrection of CVE-2006-7246 (wpa_supplicant to not to completely check certificates again):

https://bugzilla.novell.com/show_bug.cgi?id=777228

Comment 7 Josh Bressers 2014-06-13 16:34:09 UTC
We expect this to be fixed upstream in a future release.

Comment 8 Fedora Update System 2016-04-02 15:55:01 UTC
NetworkManager-1.2.0-0.8.beta3.fc24, NetworkManager-fortisslvpn-1.2.0-0.4.beta3.fc24, NetworkManager-libreswan-1.2.0-0.4.beta3.fc24, NetworkManager-openconnect-1.2.0-0.3.beta3.fc24, NetworkManager-openvpn-1.2.0-0.3.beta3.fc24, NetworkManager-pptp-1.2.0-0.3.beta3.fc24, NetworkManager-strongswan-1.3.1-3.20160330libnm.fc24, NetworkManager-vpnc-1.2.0-0.4.beta3.fc24, network-manager-applet-1.2.0-0.3.beta3.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.