blob: 5e278eb325dd5b74cc24aa7a37de7097df587880 [file] [log] [blame]
<?xml version="1.0" encoding="utf-8"?>
<glsa id="200704-15">
<title>MadWifi: Multiple vulnerabilities</title>
Multiple vulnerabilities have been discovered in the MadWifi driver,
possibly leading to a Denial of Service and information disclosure.
<product type="ebuild">Madwifi-ng</product>
<announced>April 17, 2007</announced>
<revised>April 21, 2007: 02</revised>
<package name="net-wireless/madwifi-ng" auto="yes" arch="*">
<unaffected range="ge">0.9.3</unaffected>
<vulnerable range="lt">0.9.3</vulnerable>
The MadWifi driver provides support for Atheros based IEEE 802.11
Wireless Lan cards.
The driver does not properly process Channel Switch Announcement
Information Elements, allowing for an abnormal channel change. The
ieee80211_input() function does not properly handle AUTH frames and the
driver sends unencrypted packets before WPA authentication succeeds.
<impact type="normal">
A remote attacker could send specially crafted AUTH frames to the
vulnerable host, resulting in a Denial of Service by crashing the
kernel. A remote attacker could gain access to sensitive information
about network architecture by sniffing unencrypted packets. A remote
attacker could also send a Channel Switch Count less than or equal to
one to trigger a channel change, resulting in a communication loss and
a Denial of Service.
There is no known workaround at this time.
All MadWifi users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose &quot;&gt;=net-wireless/madwifi-ng-0.9.3&quot;</code>
<uri link="">CVE-2006-7178</uri>
<uri link="">CVE-2006-7179</uri>
<uri link="">CVE-2006-7180</uri>
<metadata tag="submitter" timestamp="Wed, 11 Apr 2007 12:32:14 +0000">
<metadata tag="bugReady" timestamp="Wed, 11 Apr 2007 18:16:05 +0000">