Bug 1219975 (CVE-2023-52160) - VUL-0: CVE-2023-52160: wpa_supplicant: Bypassing WiFi Authentication
Summary: VUL-0: CVE-2023-52160: wpa_supplicant: Bypassing WiFi Authentication
Status: CONFIRMED
Alias: CVE-2023-52160
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/394290/
Whiteboard: CVSSv3.1:SUSE:CVE-2023-52160:6.5:(AV:...
Keywords:
Depends on:
Blocks:
 
Reported: 2024-02-15 16:10 UTC by SMASH SMASH
Modified: 2024-07-03 05:08 UTC (History)
1 user (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description SMASH SMASH 2024-02-15 16:10:29 UTC
https://www.top10vpn.com/research/wifi-vulnerabilities/

Bypassing WiFi Authentication

We worked with Professor Vanhoef to identify major security flaws in two instances of commonly-used open-source WiFi software that leave users exposed to traffic interception and other attacks.

The first attack is on users connecting to an Enterprise WiFi network, the second is an attack on an existing home network.

Our goal with publishing this research is to raise the standard of wireless network security by identifying serious software vulnerabilities so that vendors patch them and then make sure the public is informed.

We also want to raise public awareness about the risks inherent in using shared networks and share advice on how to protect against them.
Comment 1 Marcus Meissner 2024-02-15 16:16:39 UTC
https://w1.fi/cgit/hostap/commit/?id=8e6485a1bcb0baff

patch linked in report.
Comment 2 Clemens Famulla-Conrad 2024-02-16 12:19:20 UTC
Plz also consider this info from wpa_supplicant dev http://lists.infradead.org/pipermail/hostap/2024-February/042362.html

Regardless we are going to patch wpa_supplicant.
Comment 6 Maintenance Automation 2024-03-05 16:30:12 UTC
SUSE-SU-2024:0764-1: An update that solves one vulnerability can now be installed.

Category: security (important)
Bug References: 1219975
CVE References: CVE-2023-52160
Sources used:
Basesystem Module 15-SP5 (src): wpa_supplicant-2.10-150500.3.3.1
openSUSE Leap 15.5 (src): wpa_supplicant-2.10-150500.3.3.1
SUSE Linux Enterprise Micro 5.5 (src): wpa_supplicant-2.10-150500.3.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 7 Maintenance Automation 2024-03-08 12:30:05 UTC
SUSE-SU-2024:0819-1: An update that solves one vulnerability can now be installed.

Category: security (important)
Bug References: 1219975
CVE References: CVE-2023-52160
Sources used:
openSUSE Leap Micro 5.3 (src): wpa_supplicant-2.9-150000.4.39.1
openSUSE Leap Micro 5.4 (src): wpa_supplicant-2.9-150000.4.39.1
SUSE Linux Enterprise Micro for Rancher 5.3 (src): wpa_supplicant-2.9-150000.4.39.1
SUSE Linux Enterprise Micro 5.3 (src): wpa_supplicant-2.9-150000.4.39.1
SUSE Linux Enterprise Micro for Rancher 5.4 (src): wpa_supplicant-2.9-150000.4.39.1
SUSE Linux Enterprise Micro 5.4 (src): wpa_supplicant-2.9-150000.4.39.1
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (src): wpa_supplicant-2.9-150000.4.39.1
SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (src): wpa_supplicant-2.9-150000.4.39.1
SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (src): wpa_supplicant-2.9-150000.4.39.1
SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (src): wpa_supplicant-2.9-150000.4.39.1
SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (src): wpa_supplicant-2.9-150000.4.39.1
SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (src): wpa_supplicant-2.9-150000.4.39.1
SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (src): wpa_supplicant-2.9-150000.4.39.1
SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (src): wpa_supplicant-2.9-150000.4.39.1
SUSE Linux Enterprise Server for SAP Applications 15 SP2 (src): wpa_supplicant-2.9-150000.4.39.1
SUSE Linux Enterprise Server for SAP Applications 15 SP3 (src): wpa_supplicant-2.9-150000.4.39.1
SUSE Linux Enterprise Server for SAP Applications 15 SP4 (src): wpa_supplicant-2.9-150000.4.39.1
SUSE Manager Proxy 4.3 (src): wpa_supplicant-2.9-150000.4.39.1
SUSE Manager Retail Branch Server 4.3 (src): wpa_supplicant-2.9-150000.4.39.1
SUSE Manager Server 4.3 (src): wpa_supplicant-2.9-150000.4.39.1
SUSE Enterprise Storage 7.1 (src): wpa_supplicant-2.9-150000.4.39.1
SUSE Linux Enterprise Micro 5.1 (src): wpa_supplicant-2.9-150000.4.39.1
SUSE Linux Enterprise Micro 5.2 (src): wpa_supplicant-2.9-150000.4.39.1
SUSE Linux Enterprise Micro for Rancher 5.2 (src): wpa_supplicant-2.9-150000.4.39.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 8 Maintenance Automation 2024-03-08 12:30:08 UTC
SUSE-SU-2024:0818-1: An update that solves one vulnerability can now be installed.

Category: security (important)
Bug References: 1219975
CVE References: CVE-2023-52160
Sources used:
SUSE Linux Enterprise High Performance Computing 12 SP5 (src): wpa_supplicant-2.9-23.20.1
SUSE Linux Enterprise Server 12 SP5 (src): wpa_supplicant-2.9-23.20.1
SUSE Linux Enterprise Server for SAP Applications 12 SP5 (src): wpa_supplicant-2.9-23.20.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.