Wireless Vulnerabilities & Exploits
Wireless Vulnerabilities & Exploits
WVE ID: WVE-2005-0046
Type: Vulnerability
Status: Candidate
Classification:
Denial of Service
Design Flaw
Description:
802.11 networks are vulnerable to DoS attacks that involve sending Disassociate frames to a station or network.
Discussion:
802.11 networks utilize frames to manage connection and disconnection of stations from a wireless network. These are appropriately called management frames. One type of management frame, a disassociation frame is used to disconnect a station from a wireless network and can be sent by the station or Access Point.
There are several reasons for sending these frames, ranging from the station leaving the network to the station being inactive or the AP not being able to handle the number of stations associated with it. Once a station receives a disassociation frame from the AP it will disconnect from the network, but remain in the authenticated state.
However, a problem arises in that 802.11 management frames provide no authentication. Hence it is possible for an attacker to spoof a legitimate AP's BSSID to send disassociation frames to a station. This of course will cause the station to disconnect from the network at which point it will attempt to reconnect.
If the attacker sends the disassociation frames at a high rate the station will receive another disassociation before it finishes and re-associating with the legitimate AP though. Thus, the station is blocked from using the network until the attacker stops transmitting the disassociation frames.
It is also possible to target an entire wireless network by sending disassociation frames to the broadcast address (FF:FF:FF:FF:FF:FF) instead of directing them to an individual station. This will cause all stations on the network to be disconnected -- using only one disassociation frame.
This attack is similar to a deauthentication frame DoS, however this attack leaves the station authenticated, but unassociated.
Credits
References
WVE:
WVE-2005-0019
URL:
http://standards.ieee.org/getieee802/download/802.11-1999.pdf
Released: 2000-01-01
Submitter
Andrew
Lockhart
(alockhart@networkchemistry.com)
: Network Chemistry
Submitted: Wed Nov 30 12:00:40 -0800 2005
Candidate Date: Wed Nov 30 12:01:32 -0800 2005
