Heap-based buffer overflow in the eap_server_tls_process_fragment function in eap_server_tls_common.c in the EAP authentication server in hostapd 0.6 through 1.0 allows remote attackers to cause a denial of service (crash or abort) via a small "TLS Message Length" value in an EAP-TLS message with the "More Fragments" flag set.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Heap-based buffer overflow in the eap_server_tls_process_fragment function in eap_server_tls_common.c in
    the EAP authentication server in hostapd 0.6 through 1.0 allows remote attackers to cause a denial of
    service (crash or abort) via a small "TLS Message Length" value in an EAP-TLS message with the "More
    Fragments" flag set. (CVE-2012-4445)

This patch validated the message length of EAP-TLS to avoid the potential DoS attack

Problem description :

The internal authentication server of hostapd does not sufficiently validate the message length field of EAP-TLS messages.

Multiple vulnerabilities has been discovered and corrected in hostapd :

hostapd 0.7.3, and possibly other versions before 1.0, uses 0644 permissions for /etc/hostapd/hostapd.conf, which might allow local users to obtain sensitive information such as credentials (CVE-2012-2389).

Heap-based buffer overflow in the eap_server_tls_process_fragment function in eap_server_tls_common.c in the EAP authentication server in hostapd 0.6 through 1.0 allows remote attackers to cause a denial of service (crash or abort) via a small TLS Message Length value in an EAP-TLS message with the More Fragments flag set (CVE-2012-4445).

The updated packages have been patched to correct these issues.

EAP-TLS server: Fix TLS Message Length validation

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Timo Warns discovered that the internal authentication server of hostapd, a user space IEEE 802.11 AP and IEEE 802.1X/WPA/WPA2/EAP Authenticator, is vulnerable to a buffer overflow when processing fragmented EAP-TLS messages. As a result, an internal overflow checking routine terminates the process. An attacker can abuse this flaw to conduct denial of service attacks via crafted EAP-TLS messages prior to any authentication.

ID	Name	Product	Family	Severity
401328	Alpine: multiple hostapd packages: security update to 1.0-r1 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	high
401328	Alpine: multiple hostapd packages: security update to 1.0-r1 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
74784	openSUSE Security Update : hostapd (openSUSE-SU-2012:1371-1)	Nessus	SuSE Local Security Checks	medium
63050	FreeBSD : FreeBSD -- Insufficient message length validation for EAP-TLS messages (f115f693-36b2-11e2-a633-902b343deec9)	Nessus	FreeBSD Local Security Checks	medium
62659	Mandriva Linux Security Advisory : hostapd (MDVSA-2012:168)	Nessus	Mandriva Local Security Checks	medium
62606	Fedora 17 : hostapd-0.7.3-10.fc17 (2012-15759)	Nessus	Fedora Local Security Checks	medium
62605	Fedora 16 : hostapd-0.7.3-10.fc16 (2012-15748)	Nessus	Fedora Local Security Checks	medium
62532	Fedora 18 : hostapd-1.0-3.fc18 (2012-15680)	Nessus	Fedora Local Security Checks	medium
62452	Debian DSA-2557-1 : hostapd - buffer overflow	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2012-4445

high

Tenable Plugins

high

high

medium

medium

medium

medium

medium

medium

medium