SB2017102805 - OpenSUSE Linux update for hostapd
Published: October 28, 2017
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 15 secuirty vulnerabilities.
1) Heap-based buffer overflow (CVE-ID: CVE-2015-1863)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in Heap-based buffer overflow in wpa_supplicant 1.0 through 2.4. A remote attacker can use crafted SSID information in a management frame when creating or updating P2P entries. to trigger heap-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
2) Heap-based buffer overflow (CVE-ID: CVE-2015-4141)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in The WPS UPnP function in hostapd, when using WPS AP, and wpa_supplicant, when using WPS external registrar (ER), 0.7.0 through 2.4. A remote attacker can use a negative chunk length to trigger heap-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
3) Buffer overflow (CVE-ID: CVE-2015-4142)
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
Integer underflow in the WMM Action frame parser in hostapd 0.5.5 through 2.4 and wpa_supplicant 0.7.0 through 2.4, when used for AP mode MLME/SME functionality, allows remote attackers to cause a denial of service (crash) via a crafted frame, which triggers an out-of-bounds read.
4) Buffer overflow (CVE-ID: CVE-2015-4143)
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted (1) Commit or (2) Confirm message payload.
5) Buffer overflow (CVE-ID: CVE-2015-4144)
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 does not validate that a message is long enough to contain the Total-Length field, which allows remote attackers to cause a denial of service (crash) via a crafted message.
6) Resource management error (CVE-ID: CVE-2015-4145)
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 does not validate a fragment is already being processed, which allows remote attackers to cause a denial of service (memory leak) via a crafted message.
7) Memory corruption (CVE-ID: CVE-2015-5314)
The vulnerability allows an adjacent attacker to cause DoS condition on the target system.The weakness exists in the eap_pwd_process function due to missing last fragment length validation. An adjacent attacker can submit a large buffer fragment in an EAP-pwd message, trigger memory corruption and cause the service to crash.
8) Denial of service (CVE-ID: CVE-2016-4476)
The vulnerability allows a remote unauthenticated user to cause DoS conditions on the target system.The weakness is due to improper writing of configuration file update for the WPA/WPA2 passphrase parameter. If the parameter is updated through a WPS operation or local configuration, the resulting configuration file leads to interruption of the hostapd and wpa supplicant functionality.
Successful exploitation of the vulnerability results in denial of service on the vulnerable system.
9) Key management errors (CVE-ID: CVE-2017-13078)
The vulnerability allows an adjacent attacker to force a supplicant to reinstall a previously used group key.The weakness exists in the processing of the 802.11i 4-way handshake messages of the WPA and WPA2 protocols due to ambiguities in the processing of associated protocol messages. An adjacent attacker can use man-in-the-middle techniques to retransmit previously used message exchanges between supplicant and authenticator.
10) Key management errors (CVE-ID: CVE-2017-13079)
The vulnerability allows an adjacent attacker to force a supplicant to reinstall a previously used integrity group key.The weakness exists in the processing of the 802.11i 4-way handshake messages of the WPA and WPA2 protocols due to ambiguities in the processing of associated protocol messages. An adjacent attacker can use man-in-the-middle techniques to retransmit previously used message exchanges between supplicant and authenticator.
11) Security restrictions bypass (CVE-ID: CVE-2017-13080)
The vulnerability allows an adjacent attacker to write arbitrary files on the target system.The weakness exists due to Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the group key handshake. An adjacent attacker can replay frames from access points to clients.
12) Key management errors (CVE-ID: CVE-2017-13080)
The vulnerability allows an adjacent attacker to force a supplicant to reinstall a previously used group key.The weakness exists in the processing of the 802.11i 4-way handshake messages of the WPA and WPA2 protocols due to ambiguities in the processing of associated protocol messages. An adjacent attacker can use man-in-the-middle techniques to retransmit previously used message exchanges between supplicant and authenticator.
The vulnerability is dubbed "KRACK" attack.
13) Key management errors (CVE-ID: CVE-2017-13081)
The vulnerability allows an adjacent attacker to force a supplicant to reinstall a previously used integrity group key.The weakness exists in the processing of the 802.11i 4-way handshake messages of the WPA and WPA2 protocols due to ambiguities in the processing of associated protocol messages. An adjacent attacker can use man-in-the-middle techniques to retransmit previously used message exchanges between supplicant and authenticator.
14) Key management errors (CVE-ID: CVE-2017-13087)
The vulnerability allows an adjacent attacker to force a supplicant that is compliant with the 802.11v standard to reinstall a previously used group key.The weakness exists in the processing of the 802.11v (Wireless Network Management) Sleep Mode Response frames due to ambiguities in the processing of associated protocol messages. An adjacent attacker can passively eavesdrop and retransmit previously used WNM Sleep Mode Response frames.
15) Key management errors (CVE-ID: CVE-2017-13088)
The vulnerability allows an adjacent attacker to force a supplicant that is compliant with the 802.11v standard to reinstall a previously used integrity group key.The weakness exists in the processing of the 802.11v (Wireless Network Management) Sleep Mode Response frames due to ambiguities in the processing of associated protocol messages. An adjacent attacker can passively eavesdrop and retransmit previously used WNM Sleep Mode Response frames.
Remediation
Install update from vendor's website.