CVE-2012-2389: Low severity hostapd vulnerability
hostapd 0.7.3, and possibly other versions before 1.0, uses 0644 permissions for /etc/hostapd/hostapd.conf, which might allow local users to obtain sensitive information such as credentials.
Other sources
It was reported [1] that the default permissions of /etc/hostapd/hostapd.conf were insecure (0644) considering they could contain credentials (PSKs, shared radius secrets, etc.) that would then be world readable.
This is a low-impact flaw that be mitigated by changing the permissions to the file (upstream has done this now).
This was assigned CVE-2012-2389 [2] (although no credentials are written by any tools or by default to this file, so an administrator should logically tighten up the permissions if saving sensitive information to the file).
[1] https://bugzilla.novell.com/showbug.cgi?id=740964 [2] http://www.openwall.com/lists/oss-security/2012/05/23/13
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-2389?
CVE-2012-2389 is classified as a moderate severity vulnerability due to the risk of local users accessing sensitive information.
How do I fix CVE-2012-2389?
To fix CVE-2012-2389, change the permissions of /etc/hostapd/hostapd.conf to a more secure setting, such as 0600.
Which versions are affected by CVE-2012-2389?
CVE-2012-2389 affects hostapd versions prior to 1.0, including version 0.7.3.
What type of information is exposed by CVE-2012-2389?
CVE-2012-2389 may expose sensitive credentials stored in /etc/hostapd/hostapd.conf to local users.
Is CVE-2012-2389 limited to specific operating systems?
CVE-2012-2389 is primarily associated with hostapd implementations on Linux-based systems.