In p2p_copy_client_info of p2p.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution if the target device is performing a Wi-Fi Direct search, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-8.1 Android-9Android ID: A-172937525

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2021:1686 advisory.

  - In p2p_copy_client_info of p2p.c, there is a possible out of bounds write due to a missing bounds check.
    This could lead to remote code execution if the target device is performing a Wi-Fi Direct search, with no     additional execution privileges needed. User interaction is not needed for exploitation.Product:
    AndroidVersions: Android-10 Android-11 Android-8.1 Android-9Android ID: A-172937525 (CVE-2021-0326)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has wpa_supplicant packages installed that are affected by a vulnerability:

  - In p2p_copy_client_info of p2p.c, there is a possible out of bounds write due to a missing bounds check.
    This could lead to remote code execution if the target device is performing a Wi-Fi Direct search, with no     additional execution privileges needed. User interaction is not needed for exploitation.Product:
    AndroidVersions: Android-10 Android-11 Android-8.1 Android-9Android ID: A-172937525 (CVE-2021-0326)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2021:1686 advisory.

  - In p2p_copy_client_info of p2p.c, there is a possible out of bounds write due to a missing bounds check.
    This could lead to remote code execution if the target device is performing a Wi-Fi Direct search, with no     additional execution privileges needed. User interaction is not needed for exploitation.Product:
    AndroidVersions: Android-10 Android-11 Android-8.1 Android-9Android ID: A-172937525 (CVE-2021-0326)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of wpa_supplicant installed on the remote host is prior to 2.9. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2021-362-01 advisory.

  - hostapd before 2.10 and wpa_supplicant before 2.10 allow an incorrect indication of disconnection in     certain situations because source address validation is mishandled. This is a denial of service that     should have been prevented by PMF (aka management frame protection). The attacker must send a crafted     802.11 frame from a location that is within the 802.11 communications range. (CVE-2019-16275)

  - The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a     subscription request with a delivery URL on a different network segment than the fully qualified event-     subscription URL, aka the CallStranger issue. (CVE-2020-12695)

  - In p2p_copy_client_info of p2p.c, there is a possible out of bounds write due to a missing bounds check.
    This could lead to remote code execution if the target device is performing a Wi-Fi Direct search, with no     additional execution privileges needed. User interaction is not needed for exploitation.Product:
    AndroidVersions: Android-10 Android-11 Android-8.1 Android-9Android ID: A-172937525 (CVE-2021-0326)

  - In wpas_ctrl_msg_queue_timeout of ctrl_iface_unix.c, there is a possible memory corruption due to a use     after free. This could lead to local escalation of privilege with System execution privileges needed. User     interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-168314741     (CVE-2021-0535)

  - A vulnerability was discovered in how p2p/p2p_pd.c in wpa_supplicant before 2.10 processes P2P (Wi-Fi     Direct) provision discovery requests. It could result in denial of service or other impact (potentially     execution of arbitrary code), for an attacker within radio range. (CVE-2021-27803)

  - In wpa_supplicant and hostapd 2.9, forging attacks may occur because AlgorithmIdentifier parameters are     mishandled in tls/pkcs1.c and tls/x509v3.c. (CVE-2021-30004)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the wpa_supplicant package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - A vulnerability was discovered in how p2p/p2p_pd.c in     wpa_supplicant before 2.10 processes P2P (Wi-Fi Direct)     provision discovery requests. It could result in denial     of service or other impact (potentially execution of     arbitrary code), for an attacker within radio     range.(CVE-2021-27803)

  - In p2p_copy_client_info of p2p.c, there is a possible     out of bounds write due to a missing bounds check. This     could lead to remote code execution if the target     device is performing a Wi-Fi Direct search, with no     additional execution privileges needed. User     interaction is not needed for exploitation.Product:
    AndroidVersions: Android-10 Android-11 Android-8.1     Android-9Android ID: A-172937525(CVE-2021-0326)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of wpa_supplicant installed on the remote host is prior to 2.6-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1648 advisory.

  - In p2p_copy_client_info of p2p.c, there is a possible out of bounds write due to a missing bounds check.
    This could lead to remote code execution if the target device is performing a Wi-Fi Direct search, with no     additional execution privileges needed. User interaction is not needed for exploitation.Product:
    AndroidVersions: Android-10 Android-11 Android-8.1 Android-9Android ID: A-172937525 (CVE-2021-0326)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2021-1686 advisory.

    - P2P: Fix a corner case in peer addition based on PD Request (CVE-2021-27803)
    - Fix buffer overflow when processing P2P group information (CVE-2021-0326)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2021:1686 advisory.

  - wpa_supplicant: P2P group information processing vulnerability (CVE-2021-0326)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2021:1686 advisory.

    The wpa_supplicant packages contain an 802.1X Supplicant with support for WEP, WPA, WPA2 (IEEE 802.11i /     RSN), and various EAP authentication methods. They implement key negotiation with a WPA Authenticator for     client stations and controls the roaming and IEEE 802.11 authentication and association of the WLAN     driver.

    Security Fix(es):

    * wpa_supplicant: P2P group information processing vulnerability (CVE-2021-0326)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.4 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the wpa_supplicant package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A vulnerability was discovered in how p2p/p2p_pd.c in     wpa_supplicant before 2.10 processes P2P (Wi-Fi Direct)     provision discovery requests. It could result in denial     of service or other impact (potentially execution of     arbitrary code), for an attacker within radio     range.(CVE-2021-27803)

  - In p2p_copy_client_info of p2p.c, there is a possible     out of bounds write due to a missing bounds check. This     could lead to remote code execution if the target     device is performing a Wi-Fi Direct search, with no     additional execution privileges needed. User     interaction is not needed for exploitation.Product:
    AndroidVersions: Android-10 Android-11 Android-8.1     Android-9Android ID: A-172937525(CVE-2021-0326)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in wpa_supplicant and hostapd.

  - CVE-2020-12695     It was discovered that hostapd does not properly handle     UPnP subscribe messages under certain conditions,     allowing an attacker to cause a denial of service.

  - CVE-2021-0326     It was discovered that wpa_supplicant does not properly     process P2P (Wi-Fi Direct) group information from active     group owners. An attacker within radio range of the     device running P2P could take advantage of this flaw to     cause a denial of service or potentially execute     arbitrary code.

  - CVE-2021-27803     It was discovered that wpa_supplicant does not properly     process P2P (Wi-Fi Direct) provision discovery requests.
    An attacker within radio range of the device running P2P     could take advantage of this flaw to cause a denial of     service or potentially execute arbitrary code.

The remote Fedora 32 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-1a2443baa0 advisory.

  - In p2p_copy_client_info of p2p.c, there is a possible out of bounds write due to a missing bounds check.
    This could lead to remote code execution if the target device is performing a Wi-Fi Direct search, with no     additional execution privileges needed. User interaction is not needed for exploitation.Product:
    AndroidVersions: Android-10 Android-11 Android-8.1 Android-9Android ID: A-172937525 (CVE-2021-0326)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An issue has been found in wpa, a set of tools to support WPA and WPA2 (IEEE 802.11i). Missing validation of data can result in a buffer over-write, which might lead to a DoS of the wpa_supplicant process or potentially arbitrary code execution.

On request, together with this upload support for WPA-EAP-SUITE-B(-192) has been enabled.

For Debian 9 stretch, this problem has been fixed in version 2:2.4-1+deb9u8.

We recommend that you upgrade your wpa packages.

For the detailed security status of wpa please refer to its security tracker page at: https://security-tracker.debian.org/tracker/wpa

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for wpa_supplicant fixes the following issues :

  - CVE-2021-0326: P2P group information processing     vulnerability (bsc#1181777).

This update was imported from the SUSE:SLE-15:Update update project.

This update for wpa_supplicant fixes the following issues :

CVE-2021-0326: P2P group information processing vulnerability (bsc#1181777).

CVE-2019-16275: AP mode PMF disconnection protection bypass (bsc#1150934)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for wpa_supplicant fixes the following issues :

CVE-2021-0326: P2P group information processing vulnerability (bsc#1181777).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4734-1 advisory.

    It was discovered that wpa_supplicant did not properly handle P2P (Wi-Fi Direct) group information in some     situations, leading to a heap overflow. A physically proximate attacker could use this to cause a denial     of service or possibly execute arbitrary code. (CVE-2021-0326)

    It was discovered that hostapd did not properly handle UPnP subscribe messages in some circumstances. An     attacker could use this to cause a denial of service. (CVE-2020-12695)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-5f268ab238 advisory.

  - In p2p_copy_client_info of p2p.c, there is a possible out of bounds write due to a missing bounds check.
    This could lead to remote code execution if the target device is performing a Wi-Fi Direct search, with no     additional execution privileges needed. User interaction is not needed for exploitation.Product:
    AndroidVersions: Android-10 Android-11 Android-8.1 Android-9Android ID: A-172937525 (CVE-2021-0326)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
196855	RHEL 6 : wpa_supplicant (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
196798	RHEL 7 : wpa_supplicant (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
185045	Rocky Linux 8 : wpa_supplicant (RLSA-2021:1686)	Nessus	Rocky Linux Local Security Checks	high
160816	NewStart CGSL MAIN 6.02 : wpa_supplicant Vulnerability (NS-SA-2022-0062)	Nessus	NewStart CGSL Local Security Checks	high
157478	AlmaLinux 8 : wpa_supplicant (ALSA-2021:1686)	Nessus	Alma Linux Local Security Checks	high
156338	Slackware Linux 14.0 / 14.1 / 14.2 / current wpa_supplicant Multiple Vulnerabilities (SSA:2021-362-01)	Nessus	Slackware Local Security Checks	high
151176	EulerOS Virtualization for ARM 64 3.0.6.0 : wpa_supplicant (EulerOS-SA-2021-2009)	Nessus	Huawei Local Security Checks	high
150976	Amazon Linux 2 : wpa_supplicant (ALAS-2021-1648)	Nessus	Amazon Linux Local Security Checks	high
149962	Oracle Linux 8 : wpa_supplicant (ELSA-2021-1686)	Nessus	Oracle Linux Local Security Checks	high
149771	CentOS 8 : wpa_supplicant (CESA-2021:1686)	Nessus	CentOS Local Security Checks	high
149694	RHEL 8 : wpa_supplicant (RHSA-2021:1686)	Nessus	Red Hat Local Security Checks	high
149538	EulerOS 2.0 SP8 : wpa_supplicant (EulerOS-SA-2021-1892)	Nessus	Huawei Local Security Checks	high
148967	Debian DSA-4898-1 : wpa - security update	Nessus	Debian Local Security Checks	high
146689	Fedora 32 : 1:wpa_supplicant (2021-1a2443baa0)	Nessus	Fedora Local Security Checks	high
146665	Debian DLA-2572-1 : wpa security update	Nessus	Debian Local Security Checks	high
146528	openSUSE Security Update : wpa_supplicant (openSUSE-2021-284)	Nessus	SuSE Local Security Checks	high
146523	SUSE SLES12 Security Update : wpa_supplicant (SUSE-SU-2021:0478-1)	Nessus	SuSE Local Security Checks	high
146517	SUSE SLES12 Security Update : wpa_supplicant (SUSE-SU-2021:0477-1)	Nessus	SuSE Local Security Checks	high
146461	SUSE SLED15 / SLES15 Security Update : wpa_supplicant (SUSE-SU-2021:0443-1)	Nessus	SuSE Local Security Checks	high
146437	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : wpa_supplicant and hostapd vulnerabilities (USN-4734-1)	Nessus	Ubuntu Local Security Checks	high
146289	Fedora 33 : 1:wpa_supplicant (2021-5f268ab238)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2021-0326

high

Tenable Plugins

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high