Bug 911126 (CVE-2013-4218) - CVE-2013-4218 wimax: Supplicant agent ships RSA private key in the package
Summary: CVE-2013-4218 wimax: Supplicant agent ships RSA private key in the package
Alias: CVE-2013-4218
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: Unspecified
OS: Unspecified
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On: 995160
Blocks: 909233
TreeView+ depends on / blocked
Reported: 2013-02-14 12:46 UTC by Florian Weimer
Modified: 2021-02-17 08:03 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2015-02-17 16:48:37 UTC

Attachments (Terms of Use)

Description Florian Weimer 2013-02-14 12:46:18 UTC
The wimax package installs a RSA private key in /usr/share/wimax/supplicant_key.pem.  We should never ship hard-coded private keys.  The embedded CA certificate in /usr/share/wimax/cacert.pem is suspicious as well.  It is unclear how device key management is supposed to work.

Comment 4 Jan Lieskovsky 2013-08-08 15:39:19 UTC
A security flaw was found in the way supplicant agent of WiMAX, an user space daemon for the Intel 2400m Wireless WiMAX link, used to manage its private key (private key was shipped together with the source code). A local attacker could use this flaw to obtain security sensitive data or, to conduct actions on behalf of private key owner.

Comment 5 Jan Lieskovsky 2013-08-08 16:45:35 UTC

This issue was found by Florian Weimer of Red Hat Product Security Team.

Comment 6 Jan Lieskovsky 2013-08-08 16:48:21 UTC
Created wimax tracking bugs for this issue:

Affects: fedora-all [bug 995160]

Comment 7 Jan Lieskovsky 2013-08-08 16:57:04 UTC
CVE Request:

Comment 8 Jan Lieskovsky 2013-08-09 07:22:18 UTC
The CVE identifier of CVE-2013-4218 has been assigned to this issue:

Comment 9 Florian Weimer 2015-02-17 16:48:37 UTC
Only Fedora 19 shipped the wimax packages, and it is now EOL.

Note You need to log in before you can comment on or make changes to this bug.