[SECURITY] [DLA 147-1] wpasupplicant security update

Package : wpasupplicant Version : 0.6.10-2.1+deb6u1 CVE ID : CVE-2014-3686 It was discovered that wpasupplicant could be tricked into executing arbitrary commands when calling action scripts...

hostapd: wpa_cli and hostapd_cli remote command execution issue

A command injection flaw was found in the way the wpacli utility executed action scripts. If wpacli was run in daemon mode to execute an action script specified using the -a command line option, and wpasupplicant was configured to connect to a P2P group, malicious P2P group parameters could cause...

Mandriva Linux Security Advisory : wpa_supplicant (MDVSA-2014:211)

Updated wpasupplicant packages fix security vulnerability : A vulnerability was found in the mechanism wpacli and hostapdcli use for executing action scripts. An unsanitized string received from a remote device can be passed to a system call resulting in arbitrary command execution under the...

openSUSE Security Update : wpa_supplicant (openSUSE-SU-2014:1313-1)

add 0001-Add-osexec-helper-to-run-external-programs.patch - add 0002-wpacli-Use-osexec-for-action-script-execution.pat ch - fixing CVE-2014-3686 bnc900611 trying to abuse the action scripts in wpacli %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in...

DEBIAN-CVE-2014-3686

wpasupplicant and hostapd 0.7.2 through 2.2, when running with certain configurations and using wpacli or hostapdcli with action scripts, allows remote attackers to execute arbitrary commands via a crafted frame...

CVE-2014-3686

wpasupplicant and hostapd 0.7.2 through 2.2, when running with certain configurations and using wpacli or hostapdcli with action scripts, allows remote attackers to execute arbitrary commands via a crafted frame...

USN-2383-1: wpa_supplicant vulnerability

Jouni Malinen discovered that the wpacli tool incorrectly sanitized strings when being used with action scripts. A remote attacker could possibly use this issue to execute arbitrary commands...

USN-2383-1 wpa, wpasupplicant vulnerability

Jouni Malinen discovered that the wpacli tool incorrectly sanitized strings when being used with action scripts. A remote attacker could possibly use this issue to execute arbitrary commands...