[ GLSA 200704-15 ] MadWifi: Multiple vulnerabilities

[GLSA]

Gentoo Linux Security Advisory

Title: MadWifi: Multiple vulnerabilities (GLSA 200704-15)
Severity: normal
Exploitable: remote
Date: April 17, 2007
Updated: April 21, 2007
Bug(s): #173434
ID: 200704-15

Synopsis

Multiple vulnerabilities have been discovered in the MadWifi driver, possibly leading to a Denial of Service and information disclosure.

Background

The MadWifi driver provides support for Atheros based IEEE 802.11 Wireless Lan cards.

Affected Packages

Package: net-wireless/madwifi-ng
Vulnerable: < 0.9.3
Unaffected: >= 0.9.3
Architectures: All supported architectures


Description

The driver does not properly process Channel Switch Announcement Information Elements, allowing for an abnormal channel change. The ieee80211_input() function does not properly handle AUTH frames and the driver sends unencrypted packets before WPA authentication succeeds.

Impact

A remote attacker could send specially crafted AUTH frames to the vulnerable host, resulting in a Denial of Service by crashing the kernel. A remote attacker could gain access to sensitive information about network architecture by sniffing unencrypted packets. A remote attacker could also send a Channel Switch Count less than or equal to one to trigger a channel change, resulting in a communication loss and a Denial of Service.

Workaround

There is no known workaround at this time.

Resolution

All MadWifi users should upgrade to the latest version: