PT-2014-1870 · None+5 · Hostapd+6

Published 2014-10-09 · Updated 2024-06-15 · CVE-2014-3686

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions wpa supplicant and hostapd versions 0.7.2 through 2.2

Description The issue allows remote attackers to execute arbitrary commands via a crafted frame when running with certain configurations and using wpa cli or hostapd cli with action scripts. This can lead to a violation of confidentiality, integrity, and availability of protected information. The exploitation of this issue can be carried out remotely.

Recommendations For versions 0.7.2 through 2.2, consider disabling the use of wpa cli or hostapd cli with action scripts until a patch is available. Restrict access to the vulnerable configurations to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2014-2256

ALT-PU-2014-2257

BDU:2015-07629

BDU:2015-07630

BDU:2015-09197

BDU:2015-09198

CESA-2014_1956

CVE-2014-3686

DLA-147-1

DSA-3052-1

MGASA-2014-0429

OPENSUSE-SU-2024:10022-1

OPENSUSE-SU-2024:10499-1

RHSA-2014:1956

RHSA-2014_1956

SUSE-SU-2014_1356-1

SUSE-SU-2015:1013-1

SUSE-SU-2015_1013-1

USN-2383-1

Affected Products

Alt Linux

Centos

Red Hat

Suse

Ubuntu

Hostapd

Wpa Supplicant

References · 80

• https://osv.dev/vulnerability/USN-2383-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2015:1013-1 · Vendor Advisory
• http://debian.org/security/2014/dsa-3052 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-3686 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09198 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3686 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-3686 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-07629 · Security Note
• https://osv.dev/vulnerability/CVE-2014-3686 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2014-3686 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2015:120 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-07630 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10022-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2383-1 · Vendor Advisory
• https://security.gentoo.org/glsa/201606-17 · Vendor Advisory