PT-2015-6431 · Linux+3 · Hostapd+4
Kostya Kortchinsky
·
Publicado
2015-06-01
·
Atualizado
2024-06-15
·
CVE-2015-4145
CVSS v2.0
5.0
Média
| Vetor | AV:N/AC:L/Au:N/C:N/I:N/A:P |
Name of the Vulnerable Software and Affected Versions
hostapd and wpa supplicant versions 1.0 through 2.4
Description
The issue concerns the EAP-pwd server and peer implementation, which fails to validate if a fragment is already being processed. This allows remote attackers to cause a denial of service, specifically a memory leak, by sending a crafted message. No information is provided about the estimated number of potentially affected devices or real-world incidents where this issue was exploited.
Recommendations
For hostapd and wpa supplicant versions 1.0 through 2.4, consider applying a patch or update that addresses the EAP-pwd server and peer implementation issue to prevent the denial of service caused by the memory leak.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
DoS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Suse
Ubuntu
Hostapd
Wpa Supplicant