Arch Linux Security Advisory ASA-201410-8 ========================================= Severity: Critical Date : 2014-10-20 CVE-ID : CVE-2014-3686 Package : wpa_supplicant, hostapd Type : Arbitrary command execution Remote : yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package wpa_supplicant and hostapd before version 2.3-1 are vulnerable to arbitrary command execution. Resolution ========== Upgrade to 2.3-1. # pacman -Syu "wpa_supplicant>=2.3-1" "hostapd>=2.3-1" The problem has been fixed upstream in version 2.3. Workaround ========== Disable use of wpa_cli/hostapd_cli command to run action scripts (this may break functionality). Description =========== Jouni Malinen discovered an input sanitization issue in the wpa_cli and hostapd_cli tools included in the wpa_supplicant and hostapd packages. A remote wifi system within range could provide a crafted frame triggering arbitrary command execution under the privileges of the wpa_cli/hostapd_cli process. Impact ====== A remote attacker is able to perform arbitrary command execution with the with privileges of the affected process. References ========== http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3686 https://bugs.archlinux.org/task/42401 http://www.openwall.com/lists/oss-security/2014/10/09/28 http://w1.fi/security/2014-1/