Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 10 Nov 2015 19:48:08 +0200
From: Jouni Malinen <j@...fi>
To: oss-security@...ts.openwall.com
Subject: hostapd/wpa_supplicant: EAP-pwd missing last fragment length
 validation

EAP-pwd missing last fragment length validation

Published: November 10, 2015
Identifier: CVE-2015-5314 (hostapd), CVE-2015-5315 (wpa_supplicant)
Latest version available from: http://w1.fi/security/2015-7/


Vulnerability

A vulnerability was found in EAP-pwd server and peer implementation used
in hostapd and wpa_supplicant, respectively. When an incoming EAP-pwd
message is fragmented, the remaining reassembly buffer length was not
checked for the last fragment (but was checked for other
fragments). This allowed a suitably constructed last fragment frame to
try to add extra data that would go beyond the buffer. The length
validation code in wpabuf_put_data() prevents an actual buffer write
overflow from occurring, but this results in process termination.

For hostapd used with an internal EAP server and EAP-pwd enabled in the
runtime configuration, this could allow a denial of service attack by an
attacker within radio range of the AP device.

For hostapd used as a RADIUS server with EAP-pwd enabled in the runtime
configuration, this could allow a denial of service attack by an
attacker within radio range of any AP device that is authorized to use
the RADIUS server.

For wpa_supplicant with EAP-pwd enabled in a network configuration
profile, this could allow a denial of service attack by an attacker
within radio range.


Vulnerable versions/configurations

hostapd v2.0-v2.5 with CONFIG_EAP_PWD=y in the build configuration
(hostapd/.config) and EAP-pwd authentication server enabled in runtime
configuration.

wpa_supplicant v2.0-v2.5 with CONFIG_EAP_PWD=y in the build
configuration (wpa_supplicant/.config) and EAP-pwd enabled in a network
profile at runtime.


Possible mitigation steps

- Merge the following commits and rebuild hostapd/wpa_supplicant:

  EAP-pwd peer: Fix last fragment length validation
  EAP-pwd server: Fix last fragment length validation

  These patches are available from http://w1.fi/security/2015-7/

- Update to hostapd/wpa_supplicant v2.6 or newer, once available

- Remove CONFIG_EAP_PWD=y from build configuration

- Disable EAP-pwd in runtime configuration

-- 
Jouni Malinen                                            PGP id EFC895FA

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.