Intel Centrino wireless network drivers fail to properly handle malformed frames

Overview

Microsoft Windows drivers for Intel Centrino wireless adapters fail to properly handle malformed frames. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary code.

Description

The Microsoft Windows drivers for Intel Centrino 2200BG and 2915ABG PRO wireless adapters fail to properly handle malformed frames. If a remote attacker within transmitting range of an affected wireless adapter sends a specially crafted frame to that adapter, they may be able to trigger this vulnerability.

Affected drivers include w22n50.sys, w22n51.sys, w29n50.sys, and w29n51.sys. For more information refer to INTEL-SA-00001.

---

Impact

An unauthenticated, remote attacker may be able to execute arbitrary code with kernel-level privileges.

---

Solution

Upgrade Intel drivers
Intel has released updates to address this issue. The Intel support site also provides a tool to assist users in determining the model and version of the wireless adapter they are using.

Public reports indicate there may be compatibility issues when installing the new drivers. Known issues with the new drivers are documented in the driver release notes. Users should consult the release notes specific to their driver before applying updates.

Users are encouraged to consult their OEM and hardware providers to determine the best way to update drivers. From Intel:
It is recommended that you obtain and use the software provided via your laptop manufacturer.

Intel® is a supplier of laptop components and does not manufacture or sell complete laptop systems. The software provided by Intel … is a generic version. Each laptop computer original equipment manufacturer (OEM) may have altered the features, incorporated customizations, or made other changes to the software or software packaging they provide. The software provided has not been verified by your laptop manufacturer as to compatibility or other operation.
See the systems affected section of this document for more details regarding updates from specific OEMs.

---

Disable the affected wireless adapter

Until updates can be applied, turning off the affected wireless adapter may mitigate this vulnerability.

---

Vendor Information

230208

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Dell Computer Corporation, Inc. __ Affected

Notified: August 11, 2006 Updated: September 08, 2006

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

See Dell’s support site for more information.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23230208 Feedback>).

Intel Corporation __ Affected

Updated: August 07, 2006

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Refer to <http://support.intel.com/support/wireless/wlan/sb/cs-023065.htm&gt;.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23230208 Feedback>).

Hewlett-Packard Company Unknown

Notified: August 11, 2006 Updated: August 10, 2006

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

IBM Corporation Unknown

Notified: August 11, 2006 Updated: August 10, 2006

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Microsoft Corporation Unknown

Notified: August 11, 2006 Updated: August 10, 2006

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

NEC Corporation Unknown

Notified: August 11, 2006 Updated: August 10, 2006

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Sony Corporation Unknown

Notified: August 11, 2006 Updated: August 10, 2006

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Toshiba Unknown

Notified: August 11, 2006 Updated: August 10, 2006

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

CVSS Metrics

Group	Score	Vector
Base
Temporal
Environmental

References

• http://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00001&languageid=en-fr
• <http://support.intel.com/support/wireless/wlan/sb/cs-005905.htm&gt;
• <http://support.intel.com/support/wireless/wlan/sb/cs-010623.htm&gt;
• <http://downloadmirror.intel.com/df-support/11141/ENG/relnotes.htm&gt;
• <http://www.f-secure.com/weblog/archives/archive-082006.html#00000940&gt;
• <http://www.f-secure.com/weblog/archives/archive-082006.html#00000938&gt;
• <ftp://download.intel.com/support/wireless/wlan/sb/3945abgug.pdf&gt;
• <http://support.intel.com/support/wireless/wlan/pro2200bg/&gt;
• <ftp://download.intel.com/support/wireless/wlan/pro2200bg/2200BGUG.PDF&gt;
• <http://www.ciac.org/ciac/bulletins/q-268.shtml&gt;

Acknowledgements

This vulnerability was reported in Intel Security Bulletin CS-023065

This document was written by Ryan Giobbi and Jeff Gennari.

Other Information

CVE IDs:	CVE-2006-3992
Severity Metric:	12.72 Date Public: