NetGear wireless driver fails to properly process certain 802.11 management frames

Overview

A buffer overflow vulnerability exists in the Netgear MA521nd5.SYS wireless driver. Successful exploitation of this vulnerability may allow an attacker to execute arbitrary code, or cause a denial-of-service condition.

Description

The MA521nd5.SYS driver is a wireless (802.11b) device driver produced by Netgear.

A buffer overflow vulnerability has been reported in the MA521nd5.SYS driver. An attacker within radio range may be able to trigger the overflow by sending a specially-crafted 802.11 management frame to a vulnerable system. Since 802.11b and 802.11g management frames are not encrypted, using wireless encryption (WEP/WPA) does not mitigate this vulnerability.

Note that Linux or Unix systems that use NDISWrapper or similar technologies to load the MA521nd5.SYS driver may also be vulnerable.

---

Impact

A remote, unauthenticated attacker may be able to execute arbitrary code, or cause a denial-of-service condition on a vulnerable system.

---

Solution

We are currently unaware of a practical solution to this problem.

---

Disable wireless adapters

Disabling wireless adapters may reduce the chances of this vulnerability being exploited.

---

Vendor Information

395496

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Netgear, Inc. Unknown

Updated: November 20, 2006

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

CVSS Metrics

Group	Score	Vector
Base
Temporal
Environmental

References

• <http://projects.info-pull.com/mokb/MOKB-18-11-2006.html&gt;
• <http://secunia.com/advisories/23036/&gt;

Acknowledgements

This issue was reported by Laurent Butti, H D Moore and LMH on the Month of Kernel Bugs website.

This document was written by Ryan Giobbi.

Other Information

CVE IDs:	CVE-2006-6059
Severity Metric:	3.99 Date Public: