Mandrake Linux Security Advisory : madwifi-source (MDKSA-2007:132)

This script is Copyright (C) 2007-2013 Tenable Network Security, Inc.


Synopsis :

The remote Mandrake Linux host is missing one or more security
updates.

Description :

The 802.11 network stack in MadWifi prior to 0.9.3.1 would alloa
remote attackers to cause a denial of service (system hang) via a
crafted length field in nested 802.3 Ethernet frames in Fast Frame
packets, which results in a NULL pointer dereference (CVE-2007-2829).

The ath_beacon_config function in MadWifi prior to 0.9.3.1 would allow
a remote attacker to cause a denial of service (system crash) via
crafted beacon interval information when scanning for access points,
which triggered a divide-by-zero error (CVE-2007-2830).

An array index error in MadWifi prior to 0.9.3.1 would allow a local
user to cause a denial of service (system crash) and possibly obtain
kerenl memory contents, as well as possibly allowing for the execution
of arbitrary code via a large negative array index value
(CVE-2007-2831).

Updated packages have been updated to 0.9.3.1 to correct these issues.
Wpa_supplicant is built using madwifi-source and has been rebuilt
using 0.9.3.1 source.

Solution :

Update the affected madwifi-source, wpa_gui and / or wpa_supplicant
packages.

Risk factor :

Critical / CVSS Base Score : 10.0
(CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)

Family: Mandriva Local Security Checks

Nessus Plugin ID: 25598 (mandrake_MDKSA-2007-132.nasl)

Bugtraq ID:

CVE ID: CVE-2007-2829
CVE-2007-2830
CVE-2007-2831

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now