CVE-2006-5710

The Airport driver for certain Orinoco based Airport cards in Darwin kernel 8.8.0 in Apple Mac OS X 10.4.8, and possibly other versions, allows remote attackers to execute arbitrary code via an 802.11 probe response frame without any valid information element IE fields after the header, which...

CVE-2006-5710

The Airport driver for certain Orinoco based Airport cards in Darwin kernel 8.8.0 in Apple Mac OS X 10.4.8, and possibly other versions, allows remote attackers to execute arbitrary code via an 802.11 probe response frame without any valid information element IE fields after the header, which...

CVE-2006-5710

CVE-2006-5710 affects Apple AirPort drivers in Darwin kernel 8.8.0 on Mac OS X 10.4.8 (and possibly related versions) via a heap-based overflow triggered by crafted 802.11 probe response frames lacking proper information elements after the header. The CERT/NVD description states a remote attacker...

Apple Airport - 802.11 Probe Response Kernel Memory Corruption (PoC) (Metasploit)

Apple Airport - 802.11 Probe Response Kernel Memory Corruption PoC Metasploit A proof-of-concept exploit has been added to the Metasploit Framework 3.0 source tree: msf use auxiliary/dos/wireless/daringphucball require 'msf/core' module Msf class Auxiliary::Dos::Wireless::DaringPhucball 'Apple...

Apple AirPort wireless vulnerable to buffer overflow

Overview Two buffer overflow vulnerabilities exist in Apple AirPort wireless drivers. If exploited, this vulnerability may allow an attacker to execute arbitrary code. Description According to Apple:Two separate stack buffer overflows exist in the AirPort wireless driver's handling of malformed...

Apple AirPort wireless drivers fails to properly handle scan cache updates

Overview An heap buffer overflow exists in the Apple AirPort wireless driver. Successful exploitation of this vulnerability may allow an attacker to execute arbitrary code, or cause a denial-of-service condition. Description Apple AirPort drivers contain a heap buffer overflow in the code that...

AirPort Update 2006-001 / Security Update 2006-005

The remote host is missing a security update regarding the drivers of the AirPort wireless card. An attacker in the proximity of the target host may exploit this flaw by sending malformed 802.11 frames to the remote host and cause a stack overflow resulting in a crash of arbitrary code execution...

FreeBSD IEEE 802.11网络子系统远程溢出漏洞

BUGTRAQ ID: 16296 CVECAN ID: CVE-2006-0226 FreeBSD的IEEE 802.11网络子系统可为无线联网实现协议协商。 FreeBSD的IEEE 802.11在处理协议协商时存在漏洞，远程攻击者可能利用此漏洞在主机上执行任意指令。 在扫描已有的无线网络时，如果处理了被破坏的IEEE 802.11信标或探测响应帧的话就会出现整数溢出，导致帧溢出缓冲区。能够广播特制信标或探测响应帧的攻击者可以在任何扫描无线网络的系统上以FreeBSD Kernel权限执行任意代码。 FreeBSD FreeBSD 6.0-STABLE FreeBSD FreeBSD...

Hostaupd IEEE 802.11 authentication daemon DoS

DoS on invalid EAPoL frame...

Stack overflow

Stack-based buffer overflow in the parseTaggedData function in WavePacket.mm in KisMAC R54 through R73p allows remote attackers to execute arbitrary code via multiple SSIDs in a Cisco vendor tag in a 802.11 management frame...

CVE-2006-1385

Stack-based buffer overflow in the parseTaggedData function in WavePacket.mm in KisMAC R54 through R73p allows remote attackers to execute arbitrary code via multiple SSIDs in a Cisco vendor tag in a 802.11 management frame...

CVE-2006-1385

KISMAC (R54–R73p) is affected by a stack-based buffer overflow in the parseTaggedData function of WavePacket.mm. The vulnerability allows remote attackers to execute arbitrary code by crafting multiple SSIDs in a Cisco vendor tag within an 802.11 management frame. The issue is triggered via malfo...

CVE-2006-1385

Stack-based buffer overflow in the parseTaggedData function in WavePacket.mm in KisMAC R54 through R73p allows remote attackers to execute arbitrary code via multiple SSIDs in a Cisco vendor tag in a 802.11 management frame...

CVE-2006-0376

The 802.11 wireless client in certain operating systems including Windows 2000, Windows XP, and Windows Server 2003 does not warn the user when 1 it establishes an association with a station in ad hoc aka peer-to-peer mode or 2 a station in ad hoc mode establishes an association with it, which...

Code injection

The 802.11 wireless client in certain operating systems including Windows 2000, Windows XP, and Windows Server 2003 does not warn the user when 1 it establishes an association with a station in ad hoc aka peer-to-peer mode or 2 a station in ad hoc mode establishes an association with it, which...

CVE-2006-0376

The 802.11 wireless client in certain operating systems including Windows 2000, Windows XP, and Windows Server 2003 does not warn the user when 1 it establishes an association with a station in ad hoc aka peer-to-peer mode or 2 a station in ad hoc mode establishes an association with it, which...

CVE-2006-0376

CVE-2006-0376 affects the 802.11 wireless client in certain Windows family systems (Windows 2000, XP, Server 2003). The vulnerability arises because the client does not warn users when it associates with an ad hoc (peer-to-peer) station, or when a station in ad hoc mode associates with it. This o...

FreeBSD IEEE 802.11 wireless network buffer overflow

Buffer overflow on parsing IEEE 802.11 control frames...

FreeBSD Security Advisory FreeBSD-SA-06:05.80211

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-06:05.80211 Security Advisory The FreeBSD Project Topic: IEEE 802.11 buffer overflow Category: core Module: net80211 Announced: 2006-01-18 Credits: Karl Janmar...

Integer overflow

Integer overflow in IEEE 802.11 network subsystem ieee80211ioctl.c in FreeBSD before 6.0-STABLE, while scanning for wireless networks, allows remote attackers to execute arbitrary code by broadcasting crafted 1 beacon or 2 probe response frames...