Lucene search

[email protected]CVE-2015-4146

HistoryJun 15, 2015 - 3:59 p.m.

CVE-2015-4146

2015-06-1515:59:10

[email protected]

web.nvd.nist.gov

cve-2015-4146

eap-pwd

hostapd

wpa_supplicant

denial of service

nvd

5.3 Medium

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.024 Low

EPSS

Percentile

89.9%

JSON

The EAP-pwd peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 does not clear the L (Length) and M (More) flags before determining if a response should be fragmented, which allows remote attackers to cause a denial of service (crash) via a crafted message.

Affected configurations

NVD

Node

w1.fiwpa_supplicantMatch1.0

w1.fiwpa_supplicantMatch1.1

w1.fiwpa_supplicantMatch2.0

w1.fiwpa_supplicantMatch2.1

w1.fiwpa_supplicantMatch2.2

w1.fiwpa_supplicantMatch2.3

w1.fiwpa_supplicantMatch2.4

Node

w1.fihostapdMatch1.0

w1.fihostapdMatch1.1

w1.fihostapdMatch2.0

w1.fihostapdMatch2.1

w1.fihostapdMatch2.2

w1.fihostapdMatch2.3

w1.fihostapdMatch2.4

Node

opensuseopensuseMatch13.1

opensuseopensuseMatch13.2

CPENameOperatorVersion
w1.fi:wpa_supplicantw1.fi wpa supplicanteq1.0
w1.fi:wpa_supplicantw1.fi wpa supplicanteq1.1
w1.fi:wpa_supplicantw1.fi wpa supplicanteq2.0
w1.fi:wpa_supplicantw1.fi wpa supplicanteq2.1
w1.fi:wpa_supplicantw1.fi wpa supplicanteq2.2
w1.fi:wpa_supplicantw1.fi wpa supplicanteq2.3
w1.fi:wpa_supplicantw1.fi wpa supplicanteq2.4

CPE	Name	Operator	Version
w1.fi:wpa_supplicant	w1.fi wpa supplicant	eq	1.0
w1.fi:wpa_supplicant	w1.fi wpa supplicant	eq	1.1
w1.fi:wpa_supplicant	w1.fi wpa supplicant	eq	2.0
w1.fi:wpa_supplicant	w1.fi wpa supplicant	eq	2.1
w1.fi:wpa_supplicant	w1.fi wpa supplicant	eq	2.2
w1.fi:wpa_supplicant	w1.fi wpa supplicant	eq	2.3
w1.fi:wpa_supplicant	w1.fi wpa supplicant	eq	2.4