The eap_pwd_process function in eap_peer/eap_pwd.c in wpa_supplicant 2.x before 2.6 does not validate that the reassembly buffer is large enough for the final fragment when EAP-pwd is enabled in a network configuration profile, which allows remote attackers to cause a denial of service (process termination) via a large final fragment in an EAP-pwd message.

Jouni Malinen reports :

wpa_supplicant unauthorized WNM Sleep Mode GTK control. (2015-6 - CVE-2015-5310)

EAP-pwd missing last fragment length validation. (2015-7 - CVE-2015-5315)

EAP-pwd peer error path failure on unexpected Confirm message. (2015-8
- CVE-2015-5316)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2808-1 advisory.

    It was discovered that wpa_supplicant incorrectly handled WMM Sleep Mode Response frame processing. A     remote attacker could use this issue to perform broadcast/multicast packet injections, or cause a denial     of service. (CVE-2015-5310)

    It was discovered that wpa_supplicant and hostapd incorrectly handled certain EAP-pwd messages. A remote     attacker could use this issue to cause a denial of service. (CVE-2015-5314, CVE-2015-5315)

    It was discovered that wpa_supplicant incorrectly handled certain EAP-pwd Confirm messages. A remote     attacker could use this issue to cause a denial of service. This issue only applied to Ubuntu 15.10.
    (CVE-2015-5316)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been discovered in wpa_supplicant and hostapd. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2015-4141     Kostya Kortchinsky of the Google Security Team     discovered a vulnerability in the WPS UPnP function with     HTTP chunked transfer encoding which may result in a     denial of service.

  - CVE-2015-4142     Kostya Kortchinsky of the Google Security Team     discovered a vulnerability in the WMM Action frame     processing which may result in a denial of service.

  - CVE-2015-4143 CVE-2015-4144 CVE-2015-4145 CVE-2015-4146     Kostya Kortchinsky of the Google Security Team     discovered that EAP-pwd payload is not properly     validated which may result in a denial of service.

  - CVE-2015-5310     Jouni Malinen discovered a flaw in the WMM Sleep Mode     Response frame processing. A remote attacker can take     advantage of this flaw to mount a denial of service.

  - CVE-2015-5314 CVE-2015-5315     Jouni Malinen discovered a flaw in the handling of     EAP-pwd messages which may result in a denial of     service.

  - CVE-2015-5316     Jouni Malinen discovered a flaw in the handling of     EAP-pwd Confirm messages which may result in a denial of     service.

  - CVE-2015-8041     Incomplete WPS and P2P NFC NDEF record payload length     validation may result in a denial of service.

ID	Name	Product	Family	Severity
90568	FreeBSD : hostapd and wpa_supplicant -- multiple vulnerabilities (976567f6-05c5-11e6-94fa-002590263bf5)	Nessus	FreeBSD Local Security Checks	medium
86848	Ubuntu 14.04 LTS : wpa_supplicant and hostapd vulnerabilities (USN-2808-1)	Nessus	Ubuntu Local Security Checks	medium
86833	Debian DSA-3397-1 : wpa - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2015-5315

medium

Tenable Plugins

medium

medium

medium