PT-2015-2966 · Google+3 · Android+3

Jouni Malinen · Published 2015-11-10 · Updated 2024-06-15 · CVE-2015-5310

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions wpa supplicant versions 2.x before 2.6

Description The issue is related to the WNM Sleep Mode code in wpa supplicant, which does not properly ignore key data in response frames when management frame protection (MFP) was not negotiated. This allows remote attackers to inject arbitrary broadcast or multicast packets or cause a denial of service. Additionally, there is a Wi-Fi module vulnerability in the Android operating system related to the lack of protection for service data, which can allow an attacker to obtain confidential information about wireless network parameters by accessing the local physical environment.

Recommendations For wpa supplicant versions 2.x before 2.6, update to version 2.6 or later to resolve the issue. As a temporary workaround, consider disabling the WNM Sleep Mode feature until a patch is available. Restrict access to the Wi-Fi module to minimize the risk of exploitation.

Fix

DoS

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2016-00081

CVE-2015-5310

DSA-3397-1

OPENSUSE-SU-2024:10499-1

SUSE-SU-2016:2305-1

USN-2808-1

Affected Products

Android

Suse

Ubuntu

Wpa Supplicant

References · 63

• https://security-tracker.debian.org/tracker/CVE-2015-5310 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-5310 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5314 · Security Note
• https://bdu.fstec.ru/vul/2015-12092 · Security Note
• http://source.android.com/security/bulletin/2016-01-01.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-5316 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4146 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5310 · Security Note
• https://osv.dev/vulnerability/DSA-3397-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4143 · Security Note
• https://security-tracker.debian.org/tracker/source-package/wpa · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-5310 · Vendor Advisory
• http://ubuntu.com/usn/USN-2808-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5316 · Security Note
• https://bdu.fstec.ru/vul/2015-12120 · Security Note