Menu
Wi-Fi client vulnerability could expose Android, Linux, BSD, other systems to attacks

Wi-Fi client vulnerability could expose Android, Linux, BSD, other systems to attacks

A flaw in the widely used wpa_supplicant wireless client can lead remote code execution

A serious flaw in a component that's used to authenticate clients on Wi-Fi networks could expose Android, Linux, BSD, and possibly Windows and Mac OS X systems to attacks.

The vulnerability is in wpa_supplicant, an open-source software implementation of the IEEE 802.11i specifications for wireless clients.

The component is cross-platform and is used to control WPA and WPA2 wireless connections on Android, Linux and BSD systems. It can also be used by some third-party wireless software on Mac OS X and Windows, but these operating systems have their own built-in supplicant implementations that are used by default.

The vulnerability stems from how wpa_supplicant parses SSID (Service Set Identifier) information from wireless network frames when the CONFIG_P2P option is enabled. If exploited, the flaw can allow attackers to crash the client (denial of service), read contents from the process's memory or inject arbitrary data into its memory, which could result in arbitrary code execution.

All versions of wpa_supplicant from 1.0 to 2.4 are vulnerable. A patch was released Wednesday and operating systems are expected to update their packages.

"The vulnerability is easiest to exploit while the device has started an active P2P operation (e.g., has ongoing P2P_FIND or P2P_LISTEN control interface command in progress)," said Jouni Malinen, maintainer of wpa_supplicant, in an advisory posted on the OSS security mailing list. "However, it may be possible, though significantly more difficult, to trigger this even without any active P2P operation in progress."

The vulnerability was discovered by the hardware research group at Alibaba and was reported to the wpa_supplicant development team by the Google security team.

Users should install the security updates for wpa_supplicant when they become available for their operating systems. A mitigation in the meantime is to disable P2P for each wireless interface in the wpa_supplicant configuration file by following instructions in the advisory.

Unfortunately, wpa_supplicant is also used on embedded devices, for which patches are not as frequently released or easy to install.


Follow Us

Join the newsletter!

Error: Please check your email address.

Tags patchesonline safetysecurityAccess control and authenticationExploits / vulnerabilities

Featured

Slideshows

Meet the top performing HP partners in NZ

Meet the top performing HP partners in NZ

HP honoured leading partners across the channel at the Partner Awards 2017 in New Zealand, recognising excellence across the entire print and personal systems portfolio.

Meet the top performing HP partners in NZ
Tech industry comes together as Lexel celebrates turning 30

Tech industry comes together as Lexel celebrates turning 30

Leading figures within the technology industry across New Zealand came together to celebrate 30 years of success for Lexel Systems, at a milestone birthday occasion at St Matthews in the City.​

Tech industry comes together as Lexel celebrates turning 30
HP re-imagines education through Auckland event launch

HP re-imagines education through Auckland event launch

HP New Zealand held an inaugural Evolve Education event at Aotea Centre in Auckland, welcoming over 70 principals, teachers and education experts to explore ways of shaping and enhancing learning using technology.

HP re-imagines education through Auckland event launch
Show Comments