A Debian bug report [1] indicated that certain versions of NetworkManager, when creating a wireless network (like a hotspot) with WPA/WPA2 security would result in an insecure network being created instead. The following steps are outlined to reproduce (reported against network-manager-gnome 0.9.2.0-1 in Debian): - Connect to a wired network. - Click the network-manager-gnome icon, and select "Create New Wireless Network..." - Type a network name. - Select "WPA & WPA2 Personal". - Click "Show password". - Paste in a secure password (from pwgen -s 12). - Click "Create". - Observe that NetworkManager's icon for the network includes the lock icon indicating a secure network. - Attempt to connect to the network from my N900. - Observe that network icon shows lack of security. - Observe that I can connect to the network and access the Internet through the network without providing the previously-specified password. He also notes that creating a network using WEP results in a secured (via WEP) network instead of an open/unsecured network which is what is reported to happen when attempting to create a WPA-based network. [1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=655972
It looks like this is corrected in newer versions of NetworkManager due to the hotspot functionality (at least I am unable to reproduce this in Fedora 16). When I create a new hotsport with WPA security, it starts but I'm unable to connect to it (my OS X laptop sees it as a device to connect to but asks for a WEP password, not WPA, and although it says it connects, I don't get an IP address in OS X). If I change this to WEP in F16, then OS X sees it as an insecure network (no padlock).
This has been assigned CVE-2012-2736 as per: http://www.openwall.com/lists/oss-security/2012/06/15/2 Patch: http://cgit.freedesktop.org/NetworkManager/NetworkManager/commit/?id=69247a00eacd00617acbf1dfcee8497437b8ad39 Note: This seems to be a kernel bug, and the current solution is to disable adhoc/WPA networks in NetworkManager, untill the kernel bug is fixed.
Statement: Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.