[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20151110174808.GB7251@w1.fi>
Date: Tue, 10 Nov 2015 19:48:08 +0200
From: Jouni Malinen <j@...fi>
To: oss-security@...ts.openwall.com
Subject: hostapd/wpa_supplicant: EAP-pwd missing last fragment length
validation
EAP-pwd missing last fragment length validation
Published: November 10, 2015
Identifier: CVE-2015-5314 (hostapd), CVE-2015-5315 (wpa_supplicant)
Latest version available from: http://w1.fi/security/2015-7/
Vulnerability
A vulnerability was found in EAP-pwd server and peer implementation used
in hostapd and wpa_supplicant, respectively. When an incoming EAP-pwd
message is fragmented, the remaining reassembly buffer length was not
checked for the last fragment (but was checked for other
fragments). This allowed a suitably constructed last fragment frame to
try to add extra data that would go beyond the buffer. The length
validation code in wpabuf_put_data() prevents an actual buffer write
overflow from occurring, but this results in process termination.
For hostapd used with an internal EAP server and EAP-pwd enabled in the
runtime configuration, this could allow a denial of service attack by an
attacker within radio range of the AP device.
For hostapd used as a RADIUS server with EAP-pwd enabled in the runtime
configuration, this could allow a denial of service attack by an
attacker within radio range of any AP device that is authorized to use
the RADIUS server.
For wpa_supplicant with EAP-pwd enabled in a network configuration
profile, this could allow a denial of service attack by an attacker
within radio range.
Vulnerable versions/configurations
hostapd v2.0-v2.5 with CONFIG_EAP_PWD=y in the build configuration
(hostapd/.config) and EAP-pwd authentication server enabled in runtime
configuration.
wpa_supplicant v2.0-v2.5 with CONFIG_EAP_PWD=y in the build
configuration (wpa_supplicant/.config) and EAP-pwd enabled in a network
profile at runtime.
Possible mitigation steps
- Merge the following commits and rebuild hostapd/wpa_supplicant:
EAP-pwd peer: Fix last fragment length validation
EAP-pwd server: Fix last fragment length validation
These patches are available from http://w1.fi/security/2015-7/
- Update to hostapd/wpa_supplicant v2.6 or newer, once available
- Remove CONFIG_EAP_PWD=y from build configuration
- Disable EAP-pwd in runtime configuration
--
Jouni Malinen PGP id EFC895FA
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
