The version of wpa_supplicant installed on the remote host is prior to 2.9. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2021-362-01 advisory.

  - hostapd before 2.10 and wpa_supplicant before 2.10 allow an incorrect indication of disconnection in     certain situations because source address validation is mishandled. This is a denial of service that     should have been prevented by PMF (aka management frame protection). The attacker must send a crafted     802.11 frame from a location that is within the 802.11 communications range. (CVE-2019-16275)

  - The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a     subscription request with a delivery URL on a different network segment than the fully qualified event-     subscription URL, aka the CallStranger issue. (CVE-2020-12695)

  - In p2p_copy_client_info of p2p.c, there is a possible out of bounds write due to a missing bounds check.
    This could lead to remote code execution if the target device is performing a Wi-Fi Direct search, with no     additional execution privileges needed. User interaction is not needed for exploitation.Product:
    AndroidVersions: Android-10 Android-11 Android-8.1 Android-9Android ID: A-172937525 (CVE-2021-0326)

  - In wpas_ctrl_msg_queue_timeout of ctrl_iface_unix.c, there is a possible memory corruption due to a use     after free. This could lead to local escalation of privilege with System execution privileges needed. User     interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-168314741     (CVE-2021-0535)

  - A vulnerability was discovered in how p2p/p2p_pd.c in wpa_supplicant before 2.10 processes P2P (Wi-Fi     Direct) provision discovery requests. It could result in denial of service or other impact (potentially     execution of arbitrary code), for an attacker within radio range. (CVE-2021-27803)

  - In wpa_supplicant and hostapd 2.9, forging attacks may occur because AlgorithmIdentifier parameters are     mishandled in tls/pkcs1.c and tls/x509v3.c. (CVE-2021-30004)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

Slackware Linux 14.0 / 14.1 / 14.2 / current wpa_supplicant Multiple Vulnerabilities (SSA:2021-362-01)

high Nessus Plugin ID 156338

Version 1.5

Version 1.4

Version 1.5 Nov 21, 2023, 2:21 PM CVSSv3 score source (set to "CVE-2021-27803") Plugin Feed: 202311211421
Version 1.4 Dec 6, 2022, 2:54 AM Reference Plugin Feed: 202212060254