You are here
Home > Preporuke > Sigurnosni nedostatak programskog paketa wpa_supplicant

Sigurnosni nedostatak programskog paketa wpa_supplicant

openSUSE Security Update: Security update for wpa_supplicant
______________________________________________________________________________

Announcement ID: openSUSE-SU-2018:3539-1
Rating: moderate
References: #1080798 #1098854 #1099835 #1104205 #1109209
#1111873
Cross-References: CVE-2018-14526
Affected Products:
openSUSE Leap 15.0
______________________________________________________________________________

An update that solves one vulnerability and has 5 fixes is
now available.

Description:

This update for wpa_supplicant provides the following fixes:

This security issues was fixe:

– CVE-2018-14526: Under certain conditions, the integrity of EAPOL-Key
messages was not checked, leading to a decryption oracle. An attacker
within range of the Access Point and client could have abused the
vulnerability to recover sensitive information (bsc#1104205)

These non-security issues were fixed:

– Fix reading private key passwords from the configuration file.
(bsc#1099835)
– Enable PWD as EAP method. This allows for password-based authentication,
which is easier to setup than most of the other methods, and is used by
the Eduroam network. (bsc#1109209)
– compile eapol_test binary to allow testing via radius proxy and server
(note: this does not match CONFIG_EAPOL_TEST which sets -Werror and
activates an assert call inside the code of wpa_supplicant)
(bsc#1111873), (fate#326725)
– Enabled timestamps in log file when being invoked by systemd service
file (bsc#1080798).
– Fixes the default file permissions of the debug log file to more sane
values, i.e. it is no longer world-readable (bsc#1098854).
– Open the debug log file with O_CLOEXEC, which will prevent file
descriptor leaking to child processes (bsc#1098854).

This update was imported from the SUSE:SLE-15:Update update project.

Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or “zypper patch”.

Alternatively you can run the command listed for your product:

– openSUSE Leap 15.0:

zypper in -t patch openSUSE-2018-1316=1

Package List:

– openSUSE Leap 15.0 (i586 x86_64):

wpa_supplicant-2.6-lp150.3.6.1
wpa_supplicant-debuginfo-2.6-lp150.3.6.1
wpa_supplicant-debugsource-2.6-lp150.3.6.1
wpa_supplicant-gui-2.6-lp150.3.6.1
wpa_supplicant-gui-debuginfo-2.6-lp150.3.6.1

References:

https://www.suse.com/security/cve/CVE-2018-14526.html
https://bugzilla.suse.com/1080798
https://bugzilla.suse.com/1098854
https://bugzilla.suse.com/1099835
https://bugzilla.suse.com/1104205
https://bugzilla.suse.com/1109209
https://bugzilla.suse.com/1111873


To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org
For additional commands, e-mail: opensuse-security-announce+help@opensuse.org

Top
More in Preporuke
Sigurnosni nedostaci programske bibioteke libgit2

Otkriveni su sigurnosni nedostaci programske biblioteke libgit2 za operacijski sustav openSUSE. Otkriveni nedostaci potencijalnim napadačima omogućuju izazivanje DoS stanja, izvođenje...

Close