PT-2012-4002 · Hostap · Hostapd

Vincent Danen · Published 2012-06-21 · Updated 2013-04-19 · CVE-2012-2389

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions hostapd versions prior to 1.0

Description The issue allows local users to potentially obtain sensitive information, such as credentials, due to the use of 0644 permissions for the /etc/hostapd/hostapd.conf file.

Recommendations For versions prior to 1.0, consider changing the permissions of the /etc/hostapd/hostapd.conf file to more restrictive settings to prevent unauthorized access.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2012-2389

Affected Products

Hostapd

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2012-2389 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2012:168 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2012-June/081983.html · Vendor Advisory
• http://openwall.com/lists/oss-security/2012/05/23/3 · Note
• https://bugzilla.novell.com/show_bug.cgi?id=740964 · Note
• http://openwall.com/lists/oss-security/2012/05/23/5 · Note
• http://openwall.com/lists/oss-security/2012/05/23/13 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=824660 · Note