Bug 978175 (CVE-2016-4477) - VUL-1: CVE-2016-4477: wpa_supplicant: local configuration update allows privilege escalation
Summary: VUL-1: CVE-2016-4477: wpa_supplicant: local configuration update allows privi...
Status: RESOLVED FIXED
Alias: CVE-2016-4477
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Clemens Famulla-Conrad
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/168543/
Whiteboard: CVSSv2:SUSE:CVE-2016-4477:4.4:(AV:L/A...
Keywords:
Depends on:
Blocks:
 
Reported: 2016-05-03 08:24 UTC by Sebastian Krahmer
Modified: 2020-06-29 06:24 UTC (History)
3 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Sebastian Krahmer 2016-05-03 08:24:12 UTC 
Also via OSS-sec:

> The local configuration update through the control interface SET_NETWORK
> command could allow privilege escalation for the local user to run code
> from a locally stored library file
>
> ... SET_CRED or SET commands, similar issue ...
>
> wpa_supplicant v0.4.0-v2.5 with control interface enabled

Use CVE-2016-4477.


rh#1332423

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1332423
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4477
http://seclists.org/oss-sec/2016/q2/189
http://w1.fi/security/2016-1/
Comment 8 Marcus Meissner 2020-03-18 08:34:40 UTC 
-> new maintainer Clemens
Comment 9 Clemens Famulla-Conrad 2020-04-23 20:48:09 UTC 
We have wpa_supplicant >=2.6