Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
[ GLSA 200704-15 ] MadWifi: Multiple vulnerabilities
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index News & Announcements
View previous topic :: View next topic  
Author Message
GLSA
Veteran
Veteran


Joined: 12 May 2004
Posts: 1563

PostPosted: Wed Apr 18, 2007 1:26 am    Post subject: [ GLSA 200704-15 ] MadWifi: Multiple vulnerabilities Reply with quote

Gentoo Linux Security Advisory

Title: MadWifi: Multiple vulnerabilities (GLSA 200704-15)
Severity: normal
Exploitable: remote
Date: April 17, 2007
Updated: April 21, 2007
Bug(s): #173434
ID: 200704-15

Synopsis

Multiple vulnerabilities have been discovered in the MadWifi driver, possibly leading to a Denial of Service and information disclosure.

Background

The MadWifi driver provides support for Atheros based IEEE 802.11 Wireless Lan cards.

Affected Packages

Package: net-wireless/madwifi-ng
Vulnerable: < 0.9.3
Unaffected: >= 0.9.3
Architectures: All supported architectures


Description

The driver does not properly process Channel Switch Announcement Information Elements, allowing for an abnormal channel change. The ieee80211_input() function does not properly handle AUTH frames and the driver sends unencrypted packets before WPA authentication succeeds.

Impact

A remote attacker could send specially crafted AUTH frames to the vulnerable host, resulting in a Denial of Service by crashing the kernel. A remote attacker could gain access to sensitive information about network architecture by sniffing unencrypted packets. A remote attacker could also send a Channel Switch Count less than or equal to one to trigger a channel change, resulting in a communication loss and a Denial of Service.

Workaround

There is no known workaround at this time.

Resolution

All MadWifi users should upgrade to the latest version:
Code:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-wireless/madwifi-ng-0.9.3"


References

CVE-2006-7178
CVE-2006-7179
CVE-2006-7180


Last edited by GLSA on Sun Apr 22, 2007 4:18 am; edited 1 time in total
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index News & Announcements All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum