[arch-security] [ASA-201510-2] hostapd: denial of service

[Christian Rebischke]

Arch Linux Security Advisory ASA-201510-2
=========================================

Severity: Medium
Date    : 2015-10-05
CVE-ID  : CVE-2015-4141 CVE-2015-4142 CVE-2015-4143 
          CVE-2015-4144 CVE-2015-4145 CVE-2015-4146
Package : hostapd
Type    : denial of service
Remote  : Yes
Link    : https://wiki.archlinux.org/index.php/CVE

Summary
=======

The package hostapd before version 2.5-1 is vulnerable to denial of service.

Resolution
==========

Upgrade to 2.5-1

# pacman -Syu "hostapd>=2.5-1"

The problem has been fixed upstream in version 2.5.

Workaround
==========

None.

Description
===========

- CVE-2015-4141 (denial of service)

A vulnerability was found in the WPS UPnP function shared by hostapd
(WPS AP) and wpa_supplicant (WPS external registrar). This
may allow a possible denial of service attack through

- CVE-2015-4142 (denial of service)

A vulnerability was found in WMM Action frame processing in a case where
hostapd or wpa_supplicant is used to implement AP mode MLME/SME
functionality (i.e., Host AP driver of a mac80211-based driver on
Linux). This vulnerability can be used to perform denial of service attacks by
an attacker that is within radio range of the AP that uses hostapd of
wpa_supplicant for MLME/SME operations.

- CVE-2015-4143 (denial of service)

The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0
through 2.4 allows remote attackers to cause a denial of service (out-of-bounds
read and crash) via a crafted (1) Commit or (2) Confirm message payload.

- CVE-2015-4144 (denial of service)

The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0
through 2.4 does not validate that a message is long enough to contain the
Total-Length field, which allows remote attackers to cause a denial of service
(crash) via a crafted message.

- CVE-2015-4145 (denial of service)

The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0
through 2.4 does not validate a fragment is already being processed, which
allows remote attackers to cause a denial of service (memory leak) via a crafted
message.

- CVE-2015-4146 (denial of service)

The EAP-pwd peer implementation in hostapd and wpa_supplicant 1.0 through 2.4
does not clear the L (Length) and M (More) flags before determining if a
response should be fragmented, which allows remote attackers to cause a denial
of service (crash) via a crafted message.

Impact
======

A remote attacker is able to crash the wifi access point.

References
==========

https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-4141
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-4142
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-4143
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-4144
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-4145
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-4146
http://w1.fi/security/2015-2/
http://w1.fi/security/2015-3/
http://w1.fi/security/2015-4/
http://w1.fi/security/2015-5/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: not available
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20151005/b7995299/attachment.asc>