CVE-2006-7246
published 2020-01-27CVE-2006-7246: NetworkManager 0.9.x does not pin a certificate's subject to an ESSID when 802.11X authentication is used.
PriorityP431medium6.8CVSS 3.1
AVAACHPRNUINSUCHIHAN
EPSS
0.88%
55.2th percentile
NetworkManager 0.9.x does not pin a certificate's subject to an ESSID when 802.11X authentication is used.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | network-manager | < network-manager 0.9.4.0-1 (bookworm) | network-manager 0.9.4.0-1 (bookworm) |
| gnome | networkmanager | 0.9.0 – 0.9.9.98 | — |
| network-manager_project | network-manager | >= 0 < 0.9.4.0-1 | 0.9.4.0-1 |
| network-manager_project | network-manager | >= 0 < 0.9.4.0-1 | 0.9.4.0-1 |
| network-manager_project | network-manager | >= 0 < 0.9.4.0-1 | 0.9.4.0-1 |
| network-manager_project | network-manager | >= 0 < 0.9.4.0-1 | 0.9.4.0-1 |
| opensuse | opensuse | — | — |
| opensuse | opensuse | — | — |
| opensuse | opensuse | — | — |
| suse | linux_enterprise_desktop | — | — |
| suse | linux_enterprise_server | — | — |
CVSS provenance
nvdv3.16.8MEDIUMCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
nvdv2.03.2LOWAV:A/AC:H/Au:N/C:P/I:P/A:N
osv6.8MEDIUM
vendor_debian6.8MEDIUM
vendor_redhat6.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
(WPA-Enterprise): Verify that the certificate is from trusted CA and matches the specified subject
vendor_redhat·2006-05-10·CVSS 6.8
CVE-2006-7246 [MEDIUM] (WPA-Enterprise): Verify that the certificate is from trusted CA and matches the specified subject
(WPA-Enterprise): Verify that the certificate is from trusted CA and matches the specified subject
NetworkManager 0.9.x does not pin a certificate's subject to an ESSID when 802.11X authentication is used.
Package: NetworkManager (Red Hat Enterprise Linux 4) - Not affected
Package: wpa_supplicant (Red Hat Enterprise Linux 4) - Under investigation
Package: NetworkManager (Red Hat Enterprise Linux 5) - Affected
Package: wpa_supplicant (Red Hat Enterprise Linux 5) - Affected
Package: NetworkManager (Red Hat Enterprise Linux 6) - Affected
Package: wpa_supplicant (Red Hat Enterprise Linux 6) - Affected
Debian
CVE-2006-7246: network-manager - NetworkManager 0.9.x does not pin a certificate's subject to an ESSID when 802.1...
vendor_debian·2006·CVSS 6.8
CVE-2006-7246 [MEDIUM] CVE-2006-7246: network-manager - NetworkManager 0.9.x does not pin a certificate's subject to an ESSID when 802.1...
NetworkManager 0.9.x does not pin a certificate's subject to an ESSID when 802.11X authentication is used.
Scope: local
bookworm: resolved (fixed in 0.9.4.0-1)
bullseye: resolved (fixed in 0.9.4.0-1)
forky: resolved (fixed in 0.9.4.0-1)
sid: resolved (fixed in 0.9.4.0-1)
trixie: resolved (fixed in 0.9.4.0-1)
GHSA
GHSA-4fg6-64q2-8jgx: NetworkManager 0
ghsa_unreviewed·2022-04-21
CVE-2006-7246 [LOW] GHSA-4fg6-64q2-8jgx: NetworkManager 0
NetworkManager 0.9.x does not pin a certificate's subject to an ESSID when 802.11X authentication is used.
OSV
CVE-2006-7246: NetworkManager 0
osv·2020-01-27·CVSS 6.8
CVE-2006-7246 [MEDIUM] CVE-2006-7246: NetworkManager 0
NetworkManager 0.9.x does not pin a certificate's subject to an ESSID when 802.11X authentication is used.
No detection rules found.
No public exploits indexed.
Bugzilla
wpa_supplicant: add support for non-substring server identity check [rhel-7]
bugzilla·2015-01-03·CVSS 5.9
[MEDIUM] wpa_supplicant: add support for non-substring server identity check [rhel-7]
wpa_supplicant: add support for non-substring server identity check [rhel-7]
Description of problem:
wpa_supplicant, linked against openssl performs this check:
if (depth == 0 && match && os_strstr(buf, match) == NULL) {
wpa_printf(MSG_WARNING, "TLS: Subject '%s' did not "
"match with '%s'", buf, match);
preverify_ok = 0;
openssl_tls_fail_event(conn, err_cert, err, depth, buf,
"Subject mismatch",
TLS_FAIL_SUBJECT_MISMATCH);
}
strstr() is vulnerable to extension attack, for instance, one would like to
match on /CN=wireless.nikhef.nl, but explicitly not match on
wireless.nikhef.nl.honestachmed.tr. There is no way to implement a secure
EAP-TTLS/PEAP configuration using public certificates this way.
When linked against GnuTLS, the problem is even worse:
if (i == 0) {
/* TODO: validate sub
Bugzilla
CVE-2006-7246 NetworkManager, wpa_supplicant (WPA-Enterprise): Verify that the certificate is from trusted CA and matches the specified subject
bugzilla·2011-11-23·CVSS 6.8
CVE-2006-7246 [MEDIUM] CVE-2006-7246 NetworkManager, wpa_supplicant (WPA-Enterprise): Verify that the certificate is from trusted CA and matches the specified subject
CVE-2006-7246 NetworkManager, wpa_supplicant (WPA-Enterprise): Verify that the certificate is from trusted CA and matches the specified subject
A security flaw was found in the way NetworkManager, a network connection manager, and wpa_supplicant, a WPA/WPA2/IEEE 802.1X supplicant, performed certificate's subject against ESSID verification, when 802.11X (WPA Enterprise) authentication scheme was used. A remote attacker, with the privilege to change a certificate on an access point, could use this flaw to conduct MITM attacks via other, valid certificate, issued by the same certification authority (CA) as that one, for the original network. In the case of password based authentication (PEAP or EAP-TTLS) a remote attacker could use this flaw to obtain and potentially discover the plaintext v
http://www.openwall.com/lists/oss-security/2010/04/22/2https://bugzilla.gnome.org/show_bug.cgi?id=341323https://bugzilla.novell.com/show_bug.cgi?id=574266https://lwn.net/Articles/468868/http://www.openwall.com/lists/oss-security/2010/04/22/2https://bugzilla.gnome.org/show_bug.cgi?id=341323https://bugzilla.novell.com/show_bug.cgi?id=574266https://lwn.net/Articles/468868/
2020-01-27
Published