Bug 782627 (CVE-2012-2736) - CVE-2012-2736 NetworkManager: creating new WPA-secured wireless network results in insecure network being created instead
Summary: CVE-2012-2736 NetworkManager: creating new WPA-secured wireless network resul...
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2012-2736
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 782632
TreeView+ depends on / blocked
 
Reported: 2012-01-18 00:07 UTC by Vincent Danen
Modified: 2021-02-24 13:24 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2015-08-22 15:56:58 UTC


Attachments (Terms of Use)

Description Vincent Danen 2012-01-18 00:07:07 UTC
A Debian bug report [1] indicated that certain versions of NetworkManager, when creating a wireless network (like a hotspot) with WPA/WPA2 security would result in an insecure network being created instead.

The following steps are outlined to reproduce (reported against network-manager-gnome 0.9.2.0-1 in Debian):

- Connect to a wired network.
- Click the network-manager-gnome icon, and select "Create New Wireless
  Network..."
- Type a network name.
- Select "WPA & WPA2 Personal".
- Click "Show password".
- Paste in a secure password (from pwgen -s 12).
- Click "Create".
- Observe that NetworkManager's icon for the network includes the lock
  icon indicating a secure network.
- Attempt to connect to the network from my N900.
- Observe that network icon shows lack of security.
- Observe that I can connect to the network and access the Internet
  through the network without providing the previously-specified
  password.

He also notes that creating a network using WEP results in a secured (via WEP) network instead of an open/unsecured network which is what is reported to happen when attempting to create a WPA-based network.

[1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=655972

Comment 1 Vincent Danen 2012-01-18 00:23:30 UTC
It looks like this is corrected in newer versions of NetworkManager due to the hotspot functionality (at least I am unable to reproduce this in Fedora 16).  When I create a new hotsport with WPA security, it starts but I'm unable to connect to it (my OS X laptop sees it as a device to connect to but asks for a WEP password, not WPA, and although it says it connects, I don't get an IP address in OS X).  If I change this to WEP in F16, then OS X sees it as an insecure network (no padlock).

Comment 3 Huzaifa S. Sidhpurwala 2012-06-15 04:57:24 UTC
This has been assigned CVE-2012-2736 as per: 

http://www.openwall.com/lists/oss-security/2012/06/15/2

Patch:

http://cgit.freedesktop.org/NetworkManager/NetworkManager/commit/?id=69247a00eacd00617acbf1dfcee8497437b8ad39

Note:
This seems to be a kernel bug, and the current solution is to disable adhoc/WPA networks in NetworkManager, untill the kernel bug is fixed.

Comment 6 Vincent Danen 2015-08-22 15:56:47 UTC
Statement:

Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.


Note You need to log in before you can comment on or make changes to this bug.