CVE-2015-0210

First published: Mon Jan 05 2015(Updated: )

It was reported [1] that wpa_supplicant does not properly check certificate subject name, which might lead to "man in the middle" attack. Relevant part of the original report: ... wpa_supplicant, linked against openssl performs this check: if (depth == 0 &amp;&amp; match &amp;&amp; os_strstr(buf, match) == NULL) { wpa_printf(MSG_WARNING, "TLS: Subject '%s' did not " "match with '%s'", buf, match); preverify_ok = 0; openssl_tls_fail_event(conn, err_cert, err, depth, buf, "Subject mismatch", TLS_FAIL_SUBJECT_MISMATCH); } strstr() is vulnerable to extension attack, for instance, one would like to match on /CN=wireless.nikhef.nl, but explicitly not match on wireless.nikhef.nl.honestachmed.tr. There is no way to implement a secure EAP-TTLS/PEAP configuration using public certificates this way. When linked against GnuTLS, the problem is even worse: if (i == 0) { /* TODO: validate subject_match and altsubject_match */ } Now, it is current best practice to run EAP-TTLS/PEAP with public certificates, because on Windows, this automatically pins the CN and CA from the certificate. ... [1]: <a class="bz_bug_link bz_status_CLOSED bz_closed bz_public " title="CLOSED ERRATA - wpa_supplicant: add support for non-substring server identity check [rhel-7]" href="show_bug.cgi?id=1178263">https://bugzilla.redhat.com/show_bug.cgi?id=1178263</a>

Credit: secalert@redhat.com

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• collector/nvd-index
• agent/type
• agent/softwarecombine
• agent/first-publish-date
• collector/mitre-cve
• source/MITRE
• agent/last-modified-date
• agent/author
• agent/references
• agent/weakness
• agent/severity
• agent/remedy
• agent/tags
• agent/event
• agent/description
• collector/redhat-bugzilla
• source/Red Hat
• alias/CVE-2015-0210
• vendor/w1.fi
• canonical/w1.fi wpa supplicant
• version/w1.fi wpa supplicant/2.0-16