Buffer overflow in hostapd - CVE-2015-4142

Vulnerability identifier: #VU32295

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2015-4142

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

Integer underflow in the WMM Action frame parser in hostapd 0.5.5 through 2.4 and wpa_supplicant 0.7.0 through 2.4, when used for AP mode MLME/SME functionality, allows remote attackers to cause a denial of service (crash) via a crafted frame, which triggers an out-of-bounds read.

hostapd
Gentoo Linux
Fedora
iPadOS
Apple iOS
Opensuse
wpa_supplicant (Alpine package)
hostapd (Alpine package)
hostapd
wpa_supplicant

Install update from vendor's website.

hostapd - update to 2.5
wpa_supplicant (Alpine package) - update to 2.3-r1
hostapd (Alpine package) - addressed in versions 2.3-r1, 2.3-r2
iPadOS - update to 15.5 19F77
Apple iOS - update to 15.5 19F77
hostapd - addressed in versions 2.0-6.el6, 2.4-2.el7, 2.4-2.fc21, 2.4-2.fc22
wpa_supplicant - addressed in versions 2.0-17.fc21, 2.4-6.fc23, 2.4-7.fc22

• http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171401.html
• http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172608.html
• http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172655.html
• http://lists.opensuse.org/opensuse-updates/2015-06/msg00019.html
• http://rhn.redhat.com/errata/RHSA-2015-1090.html
• http://rhn.redhat.com/errata/RHSA-2015-1439.html
• http://w1.fi/security/2015-3/integer-underflow-in-ap-mode-wmm-action-frame.txt
• http://www.debian.org/security/2015/dsa-3397
• http://www.openwall.com/lists/oss-security/2015/05/09/5
• http://www.openwall.com/lists/oss-security/2015/05/31/6
• http://www.securitytracker.com/id/1032625
• http://www.ubuntu.com/usn/USN-2650-1
• https://security.gentoo.org/glsa/201606-17

• Buffer overflow in hostapd
• Buffer overflow in hostapd (Alpine package)
• Buffer overflow in wpa_supplicant (Alpine package)
• OpenSUSE Linux update for hostapd
• Gentoo update for hostapd and wpa_supplicant
• Multiple vulnerabilities in Apple iOS and iPadOS
• Fedora 22 update for hostapd
• Fedora 21 update for hostapd
• Fedora EPEL 7 update for hostapd
• Fedora EPEL 6 update for hostapd
• Fedora 23 update for wpa_supplicant
• Fedora 22 update for wpa_supplicant
• Fedora 21 update for wpa_supplicant