[ASA-201610-3] hostapd: multiple issues

2016-10-04T00:00:00
ID ASA-201610-3
Type archlinux
Reporter ArchLinux
Modified 2016-10-04T00:00:00

Description

Arch Linux Security Advisory ASA-201610-3

Severity: High Date : 2016-10-04 CVE-ID : CVE-2016-4476 CVE-2016-4477 Package : hostapd Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE

Summary

The package hostapd before version 2.6-1 is vulnerable to multiple issues including privilege escalation and denial of service.

Resolution

Upgrade to 2.6-1.

pacman -Syu "hostapd>=2.6-1"

The problems have been fixed upstream in version 2.6.

Workaround

None.

Description

  • CVE-2016-4476 (denial of service)

A vulnerability was found in how hostapd and wpa_supplicant writes the configuration file update for the WPA/WPA2 passphrase parameter. If this parameter has been updated to include control characters either through a WPS operation or through local configuration change over the wpa_supplicant control interface, the resulting configuration file may prevent the hostapd and wpa_supplicant from starting when the updated file is used.

  • CVE-2016-4477 (privilege escalation)

The local configuration update through the control interface SET_NETWORK command could allow privilege escalation for the local user to run code from a locally stored library file under the same privileges as the wpa_supplicant process has. The assumption here is that a not fully trusted user/application might have access through a connection manager to set network profile parameters like psk, but would not have access to set other configuration file parameters. If the connection manager in such a case does not filter out control characters from the psk value, it could have been possible to practically update the global parameters by embedding a newline character within the psk value. In addition, the untrusted user/application would need to be able to install a library file somewhere on the device from where the wpa_supplicant process has privileges to load the library.

Impact

A remote attacker is able to perform a denial of service attack that prevents hostapd from starting. Furthermore a local attacker is able to elevate privileges by a local configuration update under certain circumstances.

References

http://www.openwall.com/lists/oss-security/2016/05/03/2 https://w1.fi/security/2016-1/psk-parameter-config-update.txt https://access.redhat.com/security/cve/CVE-2016-4476 https://access.redhat.com/security/cve/CVE-2016-4477