From 71154648c9c6b55d1fcbd6526cfe4073aa75e895 Mon Sep 17 00:00:00 2001 From: marino Date: Sun, 26 Apr 2015 16:32:34 +0000 Subject: security/vuxml: Add entry for security/wpa_supplicant Security: CVE-2015-1863 PR: 199678 --- security/vuxml/vuln.xml | 56 +++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 56 insertions(+) diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 8fde1f703aad..f3d90bc09234 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -57,6 +57,62 @@ Notes: --> + + wpa_supplicant -- P2P SSID processing vulnerability + + + wpa_supplicant + 2.4_1 + + + + +

Jouni Malinen reports:

+
A vulnerability was found in how wpa_supplicant uses SSID information + parsed from management frames that create or update P2P peer entries + (e.g., Probe Response frame or number of P2P Public Action frames). SSID + field has valid length range of 0-32 octets. However, it is transmitted + in an element that has a 8-bit length field and potential maximum + payload length of 255 octets. wpa_supplicant was not sufficiently + verifying the payload length on one of the code paths using the SSID + received from a peer device.
+
This can result in copying arbitrary data from an attacker to a fixed + length buffer of 32 bytes (i.e., a possible overflow of up to 223 + bytes). The SSID buffer is within struct p2p_device that is allocated + from heap. The overflow can override couple of variables in the struct, + including a pointer that gets freed. In addition about 150 bytes (the + exact length depending on architecture) can be written beyond the end of + the heap allocation.
+
This could result in corrupted state in heap, unexpected program + behavior due to corrupted P2P peer device information, denial of service + due to wpa_supplicant process crash, exposure of memory contents during + GO Negotiation, and potentially arbitrary code execution.
+
Vulnerable versions/configurations
+
wpa_supplicant v1.0-v2.4 with CONFIG_P2P build option enabled + (which is not compiled by default).
+
Attacker (or a system controlled by the attacker) needs to be within + radio range of the vulnerable system to send a suitably constructed + management frame that triggers a P2P peer device information to be + created or updated.
+
The vulnerability is easiest to exploit while the device has started an + active P2P operation (e.g., has ongoing P2P_FIND or P2P_LISTEN control + interface command in progress). However, it may be possible, though + significantly more difficult, to trigger this even without any active + P2P operation in progress.
+

+ + + + CVE-2015-1863 + http://w1.fi/security/2015-1/wpa_supplicant-p2p-ssid-overflow.txt + + + 2015-04-22 + 2015-04-25 + + + Several vulnerabilities found in PHP -- cgit