Lucene search

Gentoo FoundationGLSA-201606-17

HistoryJun 27, 2016 - 12:00 a.m.

hostapd and wpa_supplicant: Multiple vulnerabilities

2016-06-2700:00:00

Gentoo Foundation

security.gentoo.org

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.075 Low

EPSS

Percentile

94.1%

JSON

Background

wpa_supplicant is a WPA Supplicant with support for WPA and WPA2 (IEEE 802.11i / RSN). hostapd is a user space daemon for access point and authentication servers.

Description

Multiple vulnerabilities exist in both hostapd and wpa_supplicant. Please review the CVE identifiers for more information.

Impact

Remote attackers could execute arbitrary code with the privileges of the process or cause Denial of Service.

Workaround

There is no known workaround at this time.

Resolution

All hostapd users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose "&gt;=net-wireless/hostapd-2.5"

All wpa_supplicant users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose
 "&gt;=net-wireless/wpa_supplicant-2.5-r1"

OSVersionArchitecturePackageVersionFilename
Gentooanyallnet-wireless/hostapd< 2.5UNKNOWN
Gentooanyallnet-wireless/wpa_supplicant< 2.5-r1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Gentoo	any	all	net-wireless/hostapd	< 2.5	UNKNOWN
Gentoo	any	all	net-wireless/wpa_supplicant	< 2.5-r1	UNKNOWN

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.075 Low

EPSS

Percentile

94.1%

JSON

Related for GLSA-201606-17