Bug 756418 (CVE-2006-7246) - CVE-2006-7246 NetworkManager, wpa_supplicant (WPA-Enterprise): Verify that the certificate is from trusted CA and matches the specified subject
Summary: CVE-2006-7246 NetworkManager, wpa_supplicant (WPA-Enterprise): Verify that th...
Alias: CVE-2006-7246
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On:
Blocks: 756419
TreeView+ depends on / blocked
Reported: 2011-11-23 14:05 UTC by Jan Lieskovsky
Modified: 2019-09-29 12:48 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2014-06-13 16:34:09 UTC

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Novell 777228 0 None None None 2012-08-24 10:44:14 UTC

Description Jan Lieskovsky 2011-11-23 14:05:27 UTC
A security flaw was found in the way NetworkManager, a network connection manager, and wpa_supplicant, a WPA/WPA2/IEEE 802.1X supplicant, performed certificate's subject against ESSID verification, when 802.11X (WPA Enterprise) authentication scheme was used. A remote attacker, with the privilege to change a certificate on an access point, could use this flaw to conduct MITM attacks via other, valid certificate, issued by the same certification authority (CA) as that one, for the original network. In the case of password based authentication (PEAP or EAP-TTLS) a remote attacker could use this flaw to obtain and potentially discover the plaintext version of the password hashes of the victims.

[1] https://bugzilla.novell.com/show_bug.cgi?id=574266
[2] http://www.openwall.com/lists/oss-security/2010/04/22/2
[3] http://www.suse.de/~lnussel/The_Evil_Twin_problem_with_WPA2-Enterprise_v1.1.pdf
[4] http://lwn.net/Articles/468868/

Upstream bug reports:
[5] https://bugzilla.gnome.org/show_bug.cgi?id=341323
[6] https://bugzilla.gnome.org/show_bug.cgi?id=621484

Comment 2 Huzaifa S. Sidhpurwala 2011-12-08 08:00:01 UTC
wpa_supplicant upstream patch:


Comment 4 Jan Lieskovsky 2012-08-24 10:44:14 UTC
Some of the proposed GUI patches has been reported to be able to cause (post patching) resurrection of CVE-2006-7246 (wpa_supplicant to not to completely check certificates again):


Comment 7 Josh Bressers 2014-06-13 16:34:09 UTC
We expect this to be fixed upstream in a future release.

Comment 8 Fedora Update System 2016-04-02 15:55:01 UTC
NetworkManager-1.2.0-0.8.beta3.fc24, NetworkManager-fortisslvpn-1.2.0-0.4.beta3.fc24, NetworkManager-libreswan-1.2.0-0.4.beta3.fc24, NetworkManager-openconnect-1.2.0-0.3.beta3.fc24, NetworkManager-openvpn-1.2.0-0.3.beta3.fc24, NetworkManager-pptp-1.2.0-0.3.beta3.fc24, NetworkManager-strongswan-1.3.1-3.20160330libnm.fc24, NetworkManager-vpnc-1.2.0-0.4.beta3.fc24, network-manager-applet-1.2.0-0.3.beta3.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.