From owner-svn-ports-head@FreeBSD.ORG Sun Apr 26 16:32:35 2015 Return-Path: Delivered-To: svn-ports-head@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 66D1AC08; Sun, 26 Apr 2015 16:32:35 +0000 (UTC) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 5477A1865; Sun, 26 Apr 2015 16:32:35 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.9/8.14.9) with ESMTP id t3QGWZmf025980; Sun, 26 Apr 2015 16:32:35 GMT (envelope-from marino@FreeBSD.org) Received: (from marino@localhost) by svn.freebsd.org (8.14.9/8.14.9/Submit) id t3QGWYjc025979; Sun, 26 Apr 2015 16:32:34 GMT (envelope-from marino@FreeBSD.org) Message-Id: <201504261632.t3QGWYjc025979@svn.freebsd.org> X-Authentication-Warning: svn.freebsd.org: marino set sender to marino@FreeBSD.org using -f From: John Marino Date: Sun, 26 Apr 2015 16:32:34 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r384800 - head/security/vuxml X-SVN-Group: ports-head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-head@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: SVN commit messages for the ports tree for head List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 26 Apr 2015 16:32:35 -0000 Author: marino Date: Sun Apr 26 16:32:34 2015 New Revision: 384800 URL: https://svnweb.freebsd.org/changeset/ports/384800 Log: security/vuxml: Add entry for security/wpa_supplicant Security: CVE-2015-1863 PR: 199678 Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Sun Apr 26 14:29:35 2015 (r384799) +++ head/security/vuxml/vuln.xml Sun Apr 26 16:32:34 2015 (r384800) @@ -57,6 +57,62 @@ Notes: --> + + wpa_supplicant -- P2P SSID processing vulnerability + + + wpa_supplicant + 2.4_1 + + + + +

Jouni Malinen reports:

+
A vulnerability was found in how wpa_supplicant uses SSID information + parsed from management frames that create or update P2P peer entries + (e.g., Probe Response frame or number of P2P Public Action frames). SSID + field has valid length range of 0-32 octets. However, it is transmitted + in an element that has a 8-bit length field and potential maximum + payload length of 255 octets. wpa_supplicant was not sufficiently + verifying the payload length on one of the code paths using the SSID + received from a peer device.
+
This can result in copying arbitrary data from an attacker to a fixed + length buffer of 32 bytes (i.e., a possible overflow of up to 223 + bytes). The SSID buffer is within struct p2p_device that is allocated + from heap. The overflow can override couple of variables in the struct, + including a pointer that gets freed. In addition about 150 bytes (the + exact length depending on architecture) can be written beyond the end of + the heap allocation.
+
This could result in corrupted state in heap, unexpected program + behavior due to corrupted P2P peer device information, denial of service + due to wpa_supplicant process crash, exposure of memory contents during + GO Negotiation, and potentially arbitrary code execution.
+
Vulnerable versions/configurations
+
wpa_supplicant v1.0-v2.4 with CONFIG_P2P build option enabled + (which is not compiled by default).
+
Attacker (or a system controlled by the attacker) needs to be within + radio range of the vulnerable system to send a suitably constructed + management frame that triggers a P2P peer device information to be + created or updated.
+
The vulnerability is easiest to exploit while the device has started an + active P2P operation (e.g., has ongoing P2P_FIND or P2P_LISTEN control + interface command in progress). However, it may be possible, though + significantly more difficult, to trigger this even without any active + P2P operation in progress.
+

+ + + + CVE-2015-1863 + http://w1.fi/security/2015-1/wpa_supplicant-p2p-ssid-overflow.txt + + + 2015-04-22 + 2015-04-25 + + + Several vulnerabilities found in PHP