SB2015111002 - Denial of service in wpa_supplicant

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) NULL pointer dereference (CVE-ID: CVE-2015-5316)

The vulnerability allows a remote unauthenticated attacker to cause DoS condition on the target system.

The weakness exists in the eap_pwd_perform_confirm_exchangefunction due to NULL pointer dereference. A remote attacker can submit an EAP-pwd Confirm message prior to the Identity exchange and cause the service to crash.

2) Buffer access with incorrect length value (CVE-ID: CVE-2015-5315)

The vulnerability allows a remote unauthenticated attacker to cause DoS condition on the target system.

The weakness exists in the eap_pwd_process function due to missing last fragment length validation. A remote attacker can submit a large buffer fragment in an EAP-pwd message and cause the service to crash.

Remediation

Install update from vendor's website.

References

• http://w1.fi/security/2015-8/eap-pwd-unexpected-confirm.txt
• http://w1.fi/security/2015-7/eap-pwd-missing-last-fragment-length-validation.txt