FreeBSD 802.11 Stack Overflow

WVE ID: WVE-2006-0004

Type: Vulnerability

Status: Candidate

Classification:
Input Manipulation

Description:
The FreeBSD 6.0 802.11 stack implemented in the kernel is vulnerable to an integer overflow from specially crafted beacon and probe response packets, leading to an execution of arbitrary code at kernel level.

Discussion:
The length of the SSID tagged parameter in beacon and probe response was incorrectly processed, which could lead to an overflow of the 8-bit size integer and an invalid memory copy. This could cause an execution of arbitrary code.

Credits
Author: Karl Janmar (karl@utopiafoundation.org) : None

References
URL: ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-06:05/80211.patch
URL: http://www.signedness.org/advisories/sps-0x1.txt
URL: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-06:05.80211.asc
URL: ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-06:05/80211.patch.asc
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0226
URL: http://osvdb.org/displayvuln.php?osvdb_id=22537

Released: 2006-01-18

Submitter
: None

Submitted: Wed Jan 18 10:49:33 -0800 2006

Candidate Date: Wed Jan 18 13:36:41 -0800 2006

Menu

FreeBSD 802.11 Stack Overflow

Recent Entries

News