Test Kennung:	1.3.6.1.4.1.25623.1.0.850172
Kategorie:	SuSE Local Security Checks
Titel:	SUSE: Security Advisory for NetworkManager, wpa_supplicant, NetworkManager-gnome (SUSE-SA:2011:045)
Zusammenfassung:	The remote host is missing an update for the 'NetworkManager, wpa_supplicant, NetworkManager-gnome'; package(s) announced via the referenced advisory.
Beschreibung:	Summary: The remote host is missing an update for the 'NetworkManager, wpa_supplicant, NetworkManager-gnome' package(s) announced via the referenced advisory. Vulnerability Insight: When 802.11X authentication is used (ie WPA Enterprise) NetworkManager did not pin a certificate's subject to an ESSID. A rogue access point could therefore be used to conduct MITM attacks by using any other valid certificate issued by the same CA as used in the original network CVE-2006-7246. If password based authentication is used (e.g. via PEAP or EAP-TTLS) this means an attacker could sniff and potentially crack the password hashes of the victims. The certificate checks are only performed on newly created connections. Users must therefore delete and re-create any existing WPA Enterprise connections using e.g. nm-connection-editor to take advantage of the checks. knetworkmanager is also affected by but a fix is currently not available. Users of knetworkmanager are advised to use nm-applet for 802.11X networks instead. The following document gives a more detailed explanation about the problem in general. Administrators are advised to take the opportunity to review security of their wireless networks if 802.11X authentication is used. Vulnerability Impact: man in the middle Affected Software/OS: NetworkManager, wpa_supplicant, NetworkManager-gnome on openSUSE 11.3, openSUSE 11.4 Solution: Please install the updated package(s). CVSS Score: 3.2 CVSS Vector: AV:A/AC:H/Au:N/C:P/I:P/A:N
Querverweis:	Common Vulnerability Exposure (CVE) ID: CVE-2006-7246 http://www.openwall.com/lists/oss-security/2010/04/22/2 https://bugzilla.gnome.org/show_bug.cgi?id=341323 https://bugzilla.novell.com/show_bug.cgi?id=574266 https://lwn.net/Articles/468868/
Copyright	Copyright (C) 2011 Greenbone Networks GmbH

Dies ist nur einer von 99761 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus. Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.