Published: 15/06/2015 Updated: 30/10/2018

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 up to and including 2.4 allows remote malicious users to cause a denial of service (out-of-bounds read and crash) via a crafted (1) Commit or (2) Confirm message payload.

Vulnerable Product	Search on Vulmon	Subscribe to Product
w1.fi wpa supplicant 1.0
w1.fi wpa supplicant 2.0
w1.fi wpa supplicant 2.1
w1.fi wpa supplicant 2.2
w1.fi wpa supplicant 1.1
w1.fi wpa supplicant 2.3
w1.fi wpa supplicant 2.4
w1.fi hostapd 1.0
w1.fi hostapd 2.0
w1.fi hostapd 2.1
w1.fi hostapd 2.2
w1.fi hostapd 1.1
w1.fi hostapd 2.3
w1.fi hostapd 2.4
opensuse opensuse 13.2
opensuse opensuse 13.1

wpa_supplicant and hostapd could be made to crash if they received specially crafted network traffic ...

Debian Bug report logs - #787371 wpa: CVE-2015-4143 CVE-2015-4144 CVE-2015-4145 CVE-2015-4146: EAP-pwd missing payload length validation Package: src:wpa; Maintainer for src:wpa is Debian wpasupplicant Maintainers <wpa@packagesdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sun, 31 May 2015 2 ...

Debian Bug report logs - #787372 wpa: CVE-2015-4141: WPS UPnP vulnerability with HTTP chunked transfer encoding Package: src:wpa; Maintainer for src:wpa is Debian wpasupplicant Maintainers <wpa@packagesdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sun, 31 May 2015 20:42:02 UTC Severity: im ...

Debian Bug report logs - #795740 wpa: CVE-2015-8041: Incomplete WPS and P2P NFC NDEF record payload length validation Package: src:wpa; Maintainer for src:wpa is Debian wpasupplicant Maintainers <wpa@packagesdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sun, 16 Aug 2015 14:45:02 UTC Severi ...

Debian Bug report logs - #787373 wpa: CVE-2015-4142: Integer underflow in AP mode WMM Action frame processing Package: src:wpa; Maintainer for src:wpa is Debian wpasupplicant Maintainers <wpa@packagesdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sun, 31 May 2015 20:42:06 UTC Severity: impo ...

The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 10 through 24 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted (1) Commit or (2) Confirm message payload ...

CWE-119 http://lists.opensuse.org/opensuse-updates/2015-06/msg00019.html http://w1.fi/security/2015-4/eap-pwd-missing-payload-length-validation.txt http://www.openwall.com/lists/oss-security/2015/05/09/6 http://www.openwall.com/lists/oss-security/2015/05/31/6 https://security.gentoo.org/glsa/201606-17 http://www.debian.org/security/2015/dsa-3397 http://www.ubuntu.com/usn/USN-2650-1 https://usn.ubuntu.com/2650-1/https://nvd.nist.gov https://access.redhat.com/security/cve/cve-2015-4143

CVE-2015-4143

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect