securitybreach Posted April 23, 2015 Share Posted April 23, 2015 A serious flaw in a component that's used to authenticate clients on Wi-Fi networks could expose Android, Linux, BSD, and possibly Windows and Mac OS X systems to attacks. The vulnerability is in wpa_supplicant, an open-source software implementation of the IEEE 802.11i specifications for wireless clients. The component is cross-platform and is used to control WPA and WPA2 wireless connections on Android, Linux and BSD systems. It can also be used by some third-party wireless software on Mac OS X and Windows, but these operating systems have their own built-in supplicant implementations that are used by default. The vulnerability stems from how wpa_supplicant parses SSID (Service Set Identifier) information from wireless network frames when the CONFIG_P2P option is enabled. If exploited, the flaw can allow attackers to crash the client (denial of service), read contents from the process's memory or inject arbitrary data into its memory, which could result in arbitrary code execution. All versions of wpa_supplicant from 1.0 to 2.4 are vulnerable. A patch was released Wednesday and operating systems are expected to update their packages. "The vulnerability is easiest to exploit while the device has started an active P2P operation (e.g., has ongoing P2P_FIND or P2P_LISTEN control interface command in progress)," said Jouni Malinen, maintainer of wpa_supplicant, in an advisory posted on the OSS security mailing list. "However, it may be possible, though significantly more difficult, to trigger this even without any active P2P operation in progress." The vulnerability was discovered by the hardware research group at Alibaba and was reported to the wpa_supplicant development team by the Google security team. Users should install the security updates for wpa_supplicant when they become available for their operating systems. A mitigation in the meantime is to disable P2P for each wireless interface in the wpa_supplicant configuration file by following instructions in the advisory. Unfortunately, wpa_supplicant is also used on embedded devices, for which patches are not as frequently released or easy to install. http://www.computerw...to-attacks.html 2 Quote Link to comment Share on other sites More sharing options...
ebrke Posted April 23, 2015 Share Posted April 23, 2015 Unfortunately, wpa_supplicant is also used on embedded devices, for which patches are not as frequently released or easy to install.Yet another security vulnerability that will be with us for some time. *sigh* 2 Quote Link to comment Share on other sites More sharing options...
V.T. Eric Layton Posted April 23, 2015 Share Posted April 23, 2015 That's it. I'm finished. I'm going back to the 1980s. I'm canceling my ISP. I'm getting rid of all my computers and related hardware. I'm going to learn how to write checks and use stamps again. So long to all my cyber friends... 3 Quote Link to comment Share on other sites More sharing options...
ebrke Posted April 24, 2015 Share Posted April 24, 2015 That's it. I'm finished. I'm going back to the 1980s. I'm canceling my ISP. I'm getting rid of all my computers and related hardware. I'm going to learn how to write checks and use stamps again. So long to all my cyber friends... While I realize that you're not actually serious, I have to say that sometimes I think like that too, but it's just so handy to have the online access to things like bank accounts, credit cards, mortgage account, etc. I'm certainly more paranoid than the average person (still don't use wi fi, which I know makes me a real oddball), but even so, I'm still not at the point yet where I think I could actually shut it all down. Quote Link to comment Share on other sites More sharing options...
V.T. Eric Layton Posted April 24, 2015 Share Posted April 24, 2015 That's it. I'm finished. I'm going back to the 1980s. I'm canceling my ISP. I'm getting rid of all my computers and related hardware. I'm going to learn how to write checks and use stamps again. So long to all my cyber friends... While I realize that you're not actually serious, I have to say that sometimes I think like that too, but it's just so handy to have the online access to things like bank accounts, credit cards, mortgage account, etc. I'm certainly more paranoid than the average person (still don't use wi fi, which I know makes me a real oddball), but even so, I'm still not at the point yet where I think I could actually shut it all down. Yeah... kidding, of course, but some days... Quote Link to comment Share on other sites More sharing options...
securitybreach Posted April 24, 2015 Author Share Posted April 24, 2015 Just got the update on Archlinux: testing/wpa_supplicant 2.3-1 2.4-1 0.13 MiB 0.66 MiB 1 Quote Link to comment Share on other sites More sharing options...
lewmur Posted April 24, 2015 Share Posted April 24, 2015 Just got the update on Archlinux: testing/wpa_supplicant 2.3-1 2.4-1 0.13 MiB 0.66 MiB Got one for Mint too. 2 Quote Link to comment Share on other sites More sharing options...
V.T. Eric Layton Posted April 25, 2015 Share Posted April 25, 2015 Slackware works at its own pace. [ installed ] - wpa_supplicant-2.3-x86_64-1_slack14.1 Quote Link to comment Share on other sites More sharing options...
securitybreach Posted April 25, 2015 Author Share Posted April 25, 2015 Slackware works at its own pace. [ installed ] - wpa_supplicant-2.3-x86_64-1_slack14.1 You may want to update again as 2.3 is vulnerable From the article: All versions of wpa_supplicant from 1.0 to 2.4 are vulnerable Hence why the arch update was 2.4-1 Quote Link to comment Share on other sites More sharing options...
V.T. Eric Layton Posted April 25, 2015 Share Posted April 25, 2015 That's my point when I stated that Slack works at its own pace. Pat V. has not pushed the update into the repos yet. It'll happen... eventually. 1 Quote Link to comment Share on other sites More sharing options...
securitybreach Posted April 26, 2015 Author Share Posted April 26, 2015 Ah, I thought you built it from source and updated yourself Quote Link to comment Share on other sites More sharing options...
V.T. Eric Layton Posted April 27, 2015 Share Posted April 27, 2015 Nah... I've gotten lazy in my old age. 1 Quote Link to comment Share on other sites More sharing options...
crp Posted April 27, 2015 Share Posted April 27, 2015 wonder if this is how the Russians got into the White House network. Quote Link to comment Share on other sites More sharing options...
crp Posted April 27, 2015 Share Posted April 27, 2015 That's it. I'm finished. I'm going back to the 1980s. I'm canceling my ISP. I'm getting rid of all my computers and related hardware. I'm going to learn how to write checks and use stamps again. So long to all my cyber friends... While I realize that you're not actually serious, I have to say that sometimes I think like that too, but it's just so handy to have the online access to things like bank accounts, credit cards, mortgage account, etc. I'm certainly more paranoid than the average person (still don't use wi fi, which I know makes me a real oddball), but even so, I'm still not at the point yet where I think I could actually shut it all down. while i do use online resources for such things and work at a company that does online payments, i'm still very cautious. I think if anyone looks up their bank account information in an airport or store is doing something crazy. and while the company i work at does online payments, we do not provide a mobile app to do so. We want to see a lot more security in mobile apps communications.Enforced tunneling would be nice 2 Quote Link to comment Share on other sites More sharing options...
securitybreach Posted April 27, 2015 Author Share Posted April 27, 2015 wonder if this is how the Russians got into the White House network. Wifi doesn't travel that far.... 100 ft at best 150 feet (46 m) indoors and 300 feet (92 m) outdoors http://compnetworking.about.com/cs/wirelessproducts/f/wifirange.htm Quote Link to comment Share on other sites More sharing options...
V.T. Eric Layton Posted May 12, 2015 Share Posted May 12, 2015 Finally... [slackware-security] wpa_supplicant (SSA:2015-132-03) New wpa_supplicant packages are available for Slackware 14.0, 14.1, and -current to fix security issues. Here are the details from the Slackware 14.1 ChangeLog: +--------------------------+ patches/packages/wpa_supplicant-2.4-i486-1_slack14.1.txz: Upgraded. This update fixes potential denial of service issues. For more information, see: http://w1.fi/security/2015-1/wpa_supplicant-p2p-ssid-overflow.txt http://w1.fi/security/2015-2/wps-upnp-http-chunked-transfer-encoding.txt http://w1.fi/security/2015-3/integer-underflow-in-ap-mode-wmm-action-frame.txt http://w1.fi/security/2015-4/eap-pwd-missing-payload-length-validation.txt http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1863 (* Security fix *) +--------------------------+ 1 Quote Link to comment Share on other sites More sharing options...
securitybreach Posted May 13, 2015 Author Share Posted May 13, 2015 Yah!! Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.