Multiple integer overflows in the Intel WiMAX Network Service through 1.5.2 for Intel Wireless WiMAX Connection 2400 devices allow remote attackers to cause a denial of service (component crash) or possibly execute arbitrary code via an L5 connection with a crafted PDU value that triggers a heap-based buffer overflow within (1) L5SocketsDispatcher.c or (2) L5Connector.c.

InfraStack/OSDependent/Linux/OSAL/Services/wimaxosalcryptservices.c seems to write unencrypted passwords to the log file.

The InitMethodAndPassword function in InfraStack/OSAgnostic/WiMax/Agents/Supplicant/Source/SupplicantAgent.c in the Intel WiMAX Network Service through 1.5.2 for Intel Wireless WiMAX Connection 2400 devices uses the same RSA private key in supplicantkey.pem on all systems, which allows local users to obtain sensitive information via unspecified decryption operations.

In InfraStack/OSDependent/Linux/InfraStackModules/TraceModule/TraceModule.c, function TraceOpenLogFile, the log file (typically /var/log/wimax/wimaxd.log) is chmod'ed to 0666. Log files should not be world-writable. I'm not sure if this log file should even be world-readable (see bug 911121).

It's probably best to restrict permissions on the /var/log/wimax directory, too.