Heap-based buffer overflow in wpa_supplicant 1.0 through 2.4 allows remote attackers to cause a denial of service (crash), read memory, or possibly execute arbitrary code via crafted SSID information in a management frame when creating or updating P2P entries.

This update for hostapd fixes the following issues :

  - Fix KRACK attacks on the AP side (boo#1063479,     CVE-2017-13078, CVE-2017-13079, CVE-2017-13080,     CVE-2017-13081, CVE-2017-13087, CVE-2017-13088) :

Hostap was updated to upstream release 2.6

  - fixed EAP-pwd last fragment validation     [http://w1.fi/security/2015-7/] (CVE-2015-5314)

  - fixed WPS configuration update vulnerability with     malformed passphrase [http://w1.fi/security/2016-1/]     (CVE-2016-4476)

  - extended channel switch support for VHT bandwidth     changes

  - added support for configuring new ANQP-elements with     anqp_elem=<InfoID>:<hexdump of payload>

  - fixed Suite B 192-bit AKM to use proper PMK length     (note: this makes old releases incompatible with the     fixed behavior)

  - added no_probe_resp_if_max_sta=1 parameter to disable     Probe Response frame sending for not-associated STAs if     max_num_sta limit has been reached

  - added option (-S as command line argument) to request     all interfaces to be started at the same time

  - modified rts_threshold and fragm_threshold configuration     parameters to allow -1 to be used to disable     RTS/fragmentation

  - EAP-pwd: added support for Brainpool Elliptic Curves     (with OpenSSL 1.0.2 and newer)

  - fixed EAPOL reauthentication after FT protocol run

  - fixed FTIE generation for 4-way handshake after FT     protocol run

  - fixed and improved various FST operations

  - TLS server

  - support SHA384 and SHA512 hashes

  - support TLS v1.2 signature algorithm with SHA384 and     SHA512

  - support PKCS #5 v2.0 PBES2

  - support PKCS #5 with PKCS #12 style key decryption

  - minimal support for PKCS #12

  - support OCSP stapling (including ocsp_multi)

  - added support for OpenSSL 1.1 API changes

  - drop support for OpenSSL 0.9.8

  - drop support for OpenSSL 1.0.0

  - EAP-PEAP: support fast-connect crypto binding

  - RADIUS

  - fix Called-Station-Id to not escape SSID

  - add Event-Timestamp to all Accounting-Request packets

  - add Acct-Session-Id to Accounting-On/Off

  - add Acct-Multi-Session-Id ton Access-Request packets

  - add Service-Type (= Frames)

  - allow server to provide PSK instead of passphrase for     WPA-PSK Tunnel_password case

  - update full message for interim accounting updates

  - add Acct-Delay-Time into Accounting messages

  - add require_message_authenticator configuration option     to require CoA/Disconnect-Request packets to be     authenticated

  - started to postpone WNM-Notification frame sending by     100 ms so that the STA has some more time to configure     the key before this frame is received after the 4-way     handshake

  - VHT: added interoperability workaround for 80+80 and 160     MHz channels

  - extended VLAN support (per-STA vif, etc.)

  - fixed PMKID derivation with SAE

  - nl80211

  - added support for full station state operations

  - fix IEEE 802.1X/WEP EAP reauthentication and rekeying to     use unencrypted EAPOL frames

  - added initial MBO support; number of extensions to WNM     BSS Transition Management

  - added initial functionality for location related     operations

  - added assocresp_elements parameter to allow vendor     specific elements to be added into (Re)Association     Response frames

  - improved Public Action frame addressing

  - use Address 3 = wildcard BSSID in GAS response if a     query from an unassociated STA used that address

  - fix TX status processing for Address 3 = wildcard BSSID

  - add gas_address3 configuration parameter to control     Address 3 behavior

  - added command line parameter -i to override interface     parameter in hostapd.conf

  - added command completion support to hostapd_cli

  - added passive client taxonomy determination     (CONFIG_TAXONOMY=y compile option and 'SIGNATURE <addr>'     control interface command)

  - number of small fixes

hostapd was updated to upstream release 2.5

  - (CVE-2015-1863) is fixed in upstream release 2.5

  - fixed WPS UPnP vulnerability with HTTP chunked transfer     encoding [http://w1.fi/security/2015-2/] (CVE-2015-4141     boo#930077)

  - fixed WMM Action frame parser     [http://w1.fi/security/2015-3/] (CVE-2015-4142     boo#930078)

  - fixed EAP-pwd server missing payload length validation     [http://w1.fi/security/2015-4/] (CVE-2015-4143,     CVE-2015-4144, CVE-2015-4145, boo#930079)

  - fixed validation of WPS and P2P NFC NDEF record payload     length [http://w1.fi/security/2015-5/]

  - nl80211 :

  - fixed vendor command handling to check OUI properly

  - fixed hlr_auc_gw build with OpenSSL

  - hlr_auc_gw: allow Milenage RES length to be reduced

  - disable HT for a station that does not support WMM/QoS

  - added support for hashed password (NtHash) in EAP-pwd     server

  - fixed and extended dynamic VLAN cases

  - added EAP-EKE server support for deriving Session-Id

  - set Acct-Session-Id to a random value to make it more     likely to be unique even if the device does not have a     proper clock

  - added more 2.4 GHz channels for 20/40 MHz HT co-ex scan

  - modified SAE routines to be more robust and PWE     generation to be stronger against timing attacks

  - added support for Brainpool Elliptic Curves with SAE

  - increases maximum value accepted for cwmin/cwmax

  - added support for CCMP-256 and GCMP-256 as group ciphers     with FT

  - added Fast Session Transfer (FST) module

  - removed optional fields from RSNE when using FT with PMF     (workaround for interoperability issues with iOS 8.4)

  - added EAP server support for TLS session resumption

  - fixed key derivation for Suite B 192-bit AKM (this     breaks compatibility with the earlier version)

  - added mechanism to track unconnected stations and do     minimal band steering

  - number of small fixes

The remote host is affected by the vulnerability described in GLSA-201606-17 (hostapd and wpa_supplicant: Multiple vulnerabilities)

    Multiple vulnerabilities exist in both hostapd and wpa_supplicant.
      Please review the CVE identifiers for more information.
  Impact :

    Remote attackers could execute arbitrary code with the privileges of the       process or cause Denial of Service.
  Workaround :

    There is no known workaround at this time.

An updated wpa_supplicant package that fixes two security issues and adds one enhancement is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The wpa_supplicant package contains an 802.1X Supplicant with support for WEP, WPA, WPA2 (IEEE 802.11i / RSN), and various EAP authentication methods. It implements key negotiation with a WPA Authenticator for client stations and controls the roaming and IEEE 802.11 authentication and association of the WLAN driver.

A buffer overflow flaw was found in the way wpa_supplicant handled SSID information in the Wi-Fi Direct / P2P management frames. A specially crafted frame could allow an attacker within Wi-Fi radio range to cause wpa_supplicant to crash or, possibly, execute arbitrary code. (CVE-2015-1863)

An integer underflow flaw, leading to a buffer over-read, was found in the way wpa_supplicant handled WMM Action frames. A specially crafted frame could possibly allow an attacker within Wi-Fi radio range to cause wpa_supplicant to crash. (CVE-2015-4142)

Red Hat would like to thank Jouni Malinen of the wpa_supplicant upstream for reporting the CVE-2015-1863 issue. Upstream acknowledges Alibaba security team as the original reporter.

This update also adds the following enhancement :

* Prior to this update, wpa_supplicant did not provide a way to require the host name to be listed in an X.509 certificate's Common Name or Subject Alternative Name, and only allowed host name suffix or subject substring checks. This update introduces a new configuration directive, 'domain_match', which adds a full host name check.
(BZ#1178263)

All wpa_supplicant users are advised to upgrade to this updated package, which contains backported patches to correct these issues and add this enhancement. After installing this update, the wpa_supplicant service will be restarted automatically.

A buffer overflow flaw was found in the way wpa_supplicant handled SSID information in the Wi-Fi Direct / P2P management frames. A specially crafted frame could allow an attacker within Wi-Fi radio range to cause wpa_supplicant to crash or, possibly, execute arbitrary code. (CVE-2015-1863)

An integer underflow flaw, leading to a buffer over-read, was found in the way wpa_supplicant handled WMM Action frames. A specially crafted frame could possibly allow an attacker within Wi-Fi radio range to cause wpa_supplicant to crash. (CVE-2015-4142)

This update also adds the following enhancement :

  - Prior to this update, wpa_supplicant did not provide a     way to require the host name to be listed in an X.509     certificate's Common Name or Subject Alternative Name,     and only allowed host name suffix or subject substring     checks. This update introduces a new configuration     directive, 'domain_match', which adds a full host name     check.

After installing this update, the wpa_supplicant service will be restarted automatically.

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2015-1090 advisory.

    - P2P: Validate SSID element length before copying it (CVE-2015-1863)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

wpa_supplicant was updated to fix three security issues :

  - CVE-2015-0210: wpa_supplicant: broken certificate     subject check this adds the 'domain_match' config option     from upstream (additional to the already existing     domain_suffix_match)

  - CVE-2014-3686: hostapd command execution

  - CVE-2015-1863: P2P SSID processing vulnerability

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New wpa_supplicant packages are available for Slackware 14.0, 14.1, and -current to fix security issues.

The wireless network encryption and authentication daemon wpa_supplicant was updated to fix a security issue.

The following vulnerability was fixed :

  - CVE-2015-1863: A buffer overflow in handling SSIDs in     P2P management frames allowed attackers in radio range     to crash, expose memory content or potentially execute     arbitrary code.

Jouni Malinen reports :

A vulnerability was found in how wpa_supplicant uses SSID information parsed from management frames that create or update P2P peer entries (e.g., Probe Response frame or number of P2P Public Action frames).
SSID field has valid length range of 0-32 octets. However, it is transmitted in an element that has a 8-bit length field and potential maximum payload length of 255 octets. wpa_supplicant was not sufficiently verifying the payload length on one of the code paths using the SSID received from a peer device.

This can result in copying arbitrary data from an attacker to a fixed length buffer of 32 bytes (i.e., a possible overflow of up to 223 bytes). The SSID buffer is within struct p2p_device that is allocated from heap. The overflow can override couple of variables in the struct, including a pointer that gets freed. In addition about 150 bytes (the exact length depending on architecture) can be written beyond the end of the heap allocation.

This could result in corrupted state in heap, unexpected program behavior due to corrupted P2P peer device information, denial of service due to wpa_supplicant process crash, exposure of memory contents during GO Negotiation, and potentially arbitrary code execution.

Vulnerable versions/configurations

wpa_supplicant v1.0-v2.4 with CONFIG_P2P build option enabled (which is not compiled by default).

Attacker (or a system controlled by the attacker) needs to be within radio range of the vulnerable system to send a suitably constructed management frame that triggers a P2P peer device information to be created or updated.

The vulnerability is easiest to exploit while the device has started an active P2P operation (e.g., has ongoing P2P_FIND or P2P_LISTEN control interface command in progress). However, it may be possible, though significantly more difficult, to trigger this even without any active P2P operation in progress.

The Google security team and the smart hardware research group of Alibaba security team discovered a flaw in how wpa_supplicant used SSID information when creating or updating P2P peer entries. A remote attacker can use this flaw to cause wpa_supplicant to crash, expose memory contents, and potentially execute arbitrary code.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2577-1 advisory.

    It was discovered that wpa_supplicant incorrectly handled SSID information when creating or updating P2P     peer entries. A remote attacker could use this issue to cause wpa_supplicant to crash, resulting in a     denial of service, expose memory contents, or possibly execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
104237	openSUSE Security Update : hostapd (openSUSE-2017-1201) (KRACK)	Nessus	SuSE Local Security Checks	high
91862	GLSA-201606-17 : hostapd and wpa_supplicant: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
84198	CentOS 7 : wpa_supplicant (CESA-2015:1090)	Nessus	CentOS Local Security Checks	medium
84144	Scientific Linux Security Update : wpa_supplicant on SL7.x x86_64 (20150611)	Nessus	Scientific Linux Local Security Checks	medium
84142	RHEL 7 : wpa_supplicant (RHSA-2015:1090)	Nessus	Red Hat Local Security Checks	medium
84138	Oracle Linux 7 : wpa_supplicant (ELSA-2015-1090)	Nessus	Oracle Linux Local Security Checks	high
84079	SUSE SLED12 / SLES12 Security Update : wpa_supplicant (SUSE-SU-2015:1013-1)	Nessus	SuSE Local Security Checks	medium
83373	Slackware 14.0 / 14.1 / current : wpa_supplicant (SSA:2015-132-03)	Nessus	Slackware Local Security Checks	medium
83230	openSUSE Security Update : wpa_supplicant (openSUSE-2015-341)	Nessus	SuSE Local Security Checks	medium
83082	FreeBSD : wpa_supplicant -- P2P SSID processing vulnerability (cb9d2fcd-eb47-11e4-b03e-002590263bf5)	Nessus	FreeBSD Local Security Checks	medium
83061	Debian DSA-3233-1 : wpa - security update	Nessus	Debian Local Security Checks	medium
83052	Ubuntu 14.04 LTS : wpa_supplicant vulnerability (USN-2577-1)	Nessus	Ubuntu Local Security Checks	critical

Detections

Analytics

CVE-2015-1863

critical

Tenable Plugins

high

medium

medium

medium

medium

high

medium

medium

medium

medium

medium

critical