wpa_supplicant and hostapd 0.7.2 through 2.2, when running with certain configurations and using wpa_cli or hostapd_cli with action scripts, allows remote attackers to execute arbitrary commands via a crafted frame.

The remote host is affected by the vulnerability described in GLSA-201606-17 (hostapd and wpa_supplicant: Multiple vulnerabilities)

    Multiple vulnerabilities exist in both hostapd and wpa_supplicant.
      Please review the CVE identifiers for more information.
  Impact :

    Remote attackers could execute arbitrary code with the privileges of the       process or cause Denial of Service.
  Workaround :

    There is no known workaround at this time.

wpa_supplicant was updated to fix three security issues :

  - CVE-2015-0210: wpa_supplicant: broken certificate     subject check this adds the 'domain_match' config option     from upstream (additional to the already existing     domain_suffix_match)

  - CVE-2014-3686: hostapd command execution

  - CVE-2015-1863: P2P SSID processing vulnerability

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated wpa_supplicant and hostapd packages fix security vulnerability :

A vulnerability was found in the mechanism wpa_cli and hostapd_cli use for executing action scripts. An unsanitized string received from a remote device can be passed to a system() call resulting in arbitrary command execution under the privileges of the wpa_cli/hostapd_cli process (which may be root in common use cases) (CVE-2014-3686).

Using the Mandriva wpa_supplicant package, systems are exposed to the vulnerability if operating as a WPS registrar.

It was discovered that wpasupplicant could be tricked into executing arbitrary commands when calling action scripts.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New wpa_supplicant packages are available for Slackware 13.37, 14.0, 14.1, and -current to fix security issues.

An updated wpa_supplicant package that fixes one security issue is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The wpa_supplicant package contains an 802.1X Supplicant with support for WEP, WPA, WPA2 (IEEE 802.11i / RSN), and various EAP authentication methods. It implements key negotiation with a WPA Authenticator for client stations and controls the roaming and IEEE 802.11 authentication and association of the WLAN driver.

A command injection flaw was found in the way the wpa_cli utility executed action scripts. If wpa_cli was run in daemon mode to execute an action script (specified using the -a command line option), and wpa_supplicant was configured to connect to a P2P group, malicious P2P group parameters could cause wpa_cli to execute arbitrary code.
(CVE-2014-3686)

Red Hat would like to thank Jouni Malinen for reporting this issue.

All wpa_supplicant users are advised to upgrade to this updated package, which contains a backported patch to correct this issue.

A command injection flaw was found in the way the wpa_cli utility executed action scripts. If wpa_cli was run in daemon mode to execute an action script (specified using the -a command line option), and wpa_supplicant was configured to connect to a P2P group, malicious P2P group parameters could cause wpa_cli to execute arbitrary code.
(CVE-2014-3686)

The remote Oracle Linux 7 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2014-1956 advisory.

    [1:2.0-13]
    - Use os_exec() for action script execution (CVE-2014-3686)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update fixes a possible security issue executing scripts with wpa_cli.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2014-3686. Update to version 2.3 from upstream

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Apply fixes for CVE-2014-3686

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes a remote code execution vulnerability in wpa_supplicant's wpa_cli and hostapd_cli tools. CVE-2014-3686 has been assigned to this issue.

Additionally, password based authentication with PKCS#5v2 has been enabled.

Security fix for CVE-2014-3686. Update to version 2.3 from upstream.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated wpa_supplicant packages fix security vulnerability :

A vulnerability was found in the mechanism wpa_cli and hostapd_cli use for executing action scripts. An unsanitized string received from a remote device can be passed to a system() call resulting in arbitrary command execution under the privileges of the wpa_cli/hostapd_cli process (which may be root in common use cases) (CVE-2014-3686).

Using the wpa_supplicant package, systems are exposed to the vulnerability if operating as a WPS registrar.

- add     0001-Add-os_exec-helper-to-run-external-programs.patch

  - add     0002-wpa_cli-Use-os_exec-for-action-script-execution.pat     ch

  - fixing CVE-2014-3686 (bnc#900611) trying to abuse the     action scripts in wpa_cli

Jouni Malinen discovered an input sanitization issue in the wpa_cli and hostapd_cli tools included in the wpa package. A remote wifi system within range could provide a crafted string triggering arbitrary code execution running with privileges of the affected wpa_cli or hostapd_cli process.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2383-1 advisory.

    Jouni Malinen discovered that the wpa_cli tool incorrectly sanitized strings when being used with action     scripts. A remote attacker could possibly use this issue to execute arbitrary commands.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
91862	GLSA-201606-17 : hostapd and wpa_supplicant: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
84079	SUSE SLED12 / SLES12 Security Update : wpa_supplicant (SUSE-SU-2015:1013-1)	Nessus	SuSE Local Security Checks	medium
82373	Mandriva Linux Security Advisory : wpa_supplicant (MDVSA-2015:120)	Nessus	Mandriva Local Security Checks	medium
82130	Debian DLA-147-1 : wpasupplicant security update	Nessus	Debian Local Security Checks	medium
79872	Slackware 13.37 / 14.0 / 14.1 / current : wpa_supplicant (SSA:2014-344-07)	Nessus	Slackware Local Security Checks	medium
79726	CentOS 7 : wpa_supplicant (CESA-2014:1956)	Nessus	CentOS Local Security Checks	medium
79715	Scientific Linux Security Update : wpa_supplicant on SL7.x x86_64 (20141203)	Nessus	Scientific Linux Local Security Checks	medium
79711	RHEL 7 : wpa_supplicant (RHSA-2014:1956)	Nessus	Red Hat Local Security Checks	medium
79709	Oracle Linux 7 : wpa_supplicant (ELSA-2014-1956)	Nessus	Oracle Linux Local Security Checks	critical
79069	Fedora 21 : wpa_supplicant-2.0-12.fc21 (2014-13537)	Nessus	Fedora Local Security Checks	medium
78905	Fedora 20 : hostapd-2.3-1.fc20 (2014-13783)	Nessus	Fedora Local Security Checks	medium
78903	Fedora 19 : hostapd-2.0-5.fc19 (2014-13778)	Nessus	Fedora Local Security Checks	medium
78868	SuSE 11.3 Security Update : wpa_supplicant (SAT Patch Number 9894)	Nessus	SuSE Local Security Checks	medium
78810	Fedora 21 : hostapd-2.3-1.fc21 (2014-13608)	Nessus	Fedora Local Security Checks	medium
78731	Mandriva Linux Security Advisory : wpa_supplicant (MDVSA-2014:211)	Nessus	Mandriva Local Security Checks	medium
78727	Fedora 20 : wpa_supplicant-2.0-12.fc20 (2014-13555)	Nessus	Fedora Local Security Checks	medium
78637	openSUSE Security Update : wpa_supplicant (openSUSE-SU-2014:1313-1)	Nessus	SuSE Local Security Checks	medium
78636	openSUSE Security Update : wpa_supplicant (openSUSE-SU-2014:1314-1)	Nessus	SuSE Local Security Checks	medium
78519	Debian DSA-3052-1 : wpa - security update	Nessus	Debian Local Security Checks	medium
78468	Ubuntu 14.04 LTS : wpa_supplicant vulnerability (USN-2383-1)	Nessus	Ubuntu Local Security Checks	critical

Detections

Analytics

CVE-2014-3686

critical

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

critical