Menu
Wi-Fi client vulnerability could expose Android, Linux, BSD, other systems to attacks

Wi-Fi client vulnerability could expose Android, Linux, BSD, other systems to attacks

A flaw in the widely used wpa_supplicant wireless client can lead remote code execution

A serious flaw in a component that's used to authenticate clients on Wi-Fi networks could expose Android, Linux, BSD, and possibly Windows and Mac OS X systems to attacks.

The vulnerability is in wpa_supplicant, an open-source software implementation of the IEEE 802.11i specifications for wireless clients.

The component is cross-platform and is used to control WPA and WPA2 wireless connections on Android, Linux and BSD systems. It can also be used by some third-party wireless software on Mac OS X and Windows, but these operating systems have their own built-in supplicant implementations that are used by default.

The vulnerability stems from how wpa_supplicant parses SSID (Service Set Identifier) information from wireless network frames when the CONFIG_P2P option is enabled. If exploited, the flaw can allow attackers to crash the client (denial of service), read contents from the process's memory or inject arbitrary data into its memory, which could result in arbitrary code execution.

All versions of wpa_supplicant from 1.0 to 2.4 are vulnerable. A patch was released Wednesday and operating systems are expected to update their packages.

"The vulnerability is easiest to exploit while the device has started an active P2P operation (e.g., has ongoing P2P_FIND or P2P_LISTEN control interface command in progress)," said Jouni Malinen, maintainer of wpa_supplicant, in an advisory posted on the OSS security mailing list. "However, it may be possible, though significantly more difficult, to trigger this even without any active P2P operation in progress."

The vulnerability was discovered by the hardware research group at Alibaba and was reported to the wpa_supplicant development team by the Google security team.

Users should install the security updates for wpa_supplicant when they become available for their operating systems. A mitigation in the meantime is to disable P2P for each wireless interface in the wpa_supplicant configuration file by following instructions in the advisory.

Unfortunately, wpa_supplicant is also used on embedded devices, for which patches are not as frequently released or easy to install.

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Tags patchesonline safetysecurityAccess control and authenticationExploits / vulnerabilities

Featured

Slideshows

Kiwi channel reunites as After Hours kicks off 2017

Kiwi channel reunites as After Hours kicks off 2017

After Hours made a welcome return to the channel social calendar last night, with a bumper crowd of distributors, vendors and resellers descending on The Jefferson in Auckland to kickstart 2017. Photos by Maria Stefina.

Kiwi channel reunites as After Hours kicks off 2017
Arrow exclusively introduces Tenable Network Security to A/NZ channel

Arrow exclusively introduces Tenable Network Security to A/NZ channel

Arrow Electronics introduced Tenable Network Security to local resellers in Sydney last week, officially launching the distributor's latest security partnership across Australia and New Zealand. Representing the first direct distribution agreement locally for Tenable specifically, the deal sees Arrow deliver security solutions directly to mid-market and enterprise channel partners on both sides of the Tasman.

Arrow exclusively introduces Tenable Network Security to A/NZ channel
Examining the changing job scene in the Kiwi channel

Examining the changing job scene in the Kiwi channel

Typically, the New Year brings new opportunities for personnel within the Kiwi channel. 2017 started no differently, with a host of appointments, departures and reshuffles across vendor, distributor and reseller businesses. As a result, the job scene across New Zealand has changed - here’s a run down of who is working where in the year ahead…

Examining the changing job scene in the Kiwi channel
Show Comments