Description
hostapd 0.7.3, and possibly other versions before 1.0, uses 0644 permissions for /etc/hostapd/hostapd.conf, which might allow local users to obtain sensitive information such as credentials.
References
- https://bugzilla.redhat.com/show_bug.cgi?id=824660
- [oss-security] 20120523 Re: CVE request(?): hostapd: improper file permissions of hostapd's config leaks credentials mailing-list
- [oss-security] 20120523 Re: CVE request(?): hostapd: improper file permissions of hostapd's config leaks credentials mailing-list
- MDVSA-2012:168 vendor-advisory
- FEDORA-2012-8611 vendor-advisory
- https://bugzilla.novell.com/show_bug.cgi?id=740964
- [oss-security] 20120523 CVE request(?): hostapd: improper file permissions of hostapd's config leaks credentials mailing-list