PT-2017-6435 · Linux+1 · Wpa Supplicant+1

Vasyl Kaigorodov · Published 2015-04-21 · Updated 2018-06-12 · CVE-2015-0210

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions wpa supplicant version 2.0-16

Description The issue allows remote attackers to cause a man-in-the-middle attack due to improper checking of certificate subject names.

Recommendations For version 2.0-16, update to a newer version that properly checks certificate subject names to prevent man-in-the-middle attacks.

Exploit

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2015-0210

SUSE-SU-2015:1013-1

SUSE-SU-2018:1659-1

SUSE-SU-2018_1659-1

Affected Products

Suse

Wpa Supplicant

References · 16

• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=1178263 · Exploit
• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=1178921 · Exploit
• https://osv.dev/vulnerability/SUSE-SU-2015:1013-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-0210 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2018:1659-1 · Vendor Advisory
• https://suse.com/support/update/announcement/2018/suse-su-20181659-1 · Note
• http://lists.suse.com/mailman/listinfo/sle-security-updates · Note
• https://suse.com/security/cve/CVE-2015-0210 · Note
• https://suse.com/security/cve/CVE-2015-1863 · Note
• https://suse.com/support/update/announcement/2015/suse-su-20151013-1 · Note
• https://lists.suse.com/pipermail/sle-security-updates/2018-June/004183.html · Note
• https://suse.com/security/cve/CVE-2014-3686 · Note
• https://suse.com/security/cve/CVE-2015-0210.html · Note
• https://bugzilla.suse.com/900611 · Note
• https://bugzilla.suse.com/927558 · Note