129 lines
4.6 KiB
Text
129 lines
4.6 KiB
Text
-----BEGIN PGP SIGNED MESSAGE-----
|
|
Hash: SHA1
|
|
|
|
=============================================================================
|
|
FreeBSD-SA-12:07.hostapd Security Advisory
|
|
The FreeBSD Project
|
|
|
|
Topic: Insufficient message length validation for EAP-TLS messages
|
|
|
|
Category: contrib
|
|
Module: wpa
|
|
Announced: 2012-11-22
|
|
Credits: Timo Warns, Jouni Malinen
|
|
Affects: FreeBSD 8.0 and later.
|
|
Corrected: 2012-11-22 22:52:15 UTC (RELENG_8, 8.3-STABLE)
|
|
2012-11-22 22:52:15 UTC (RELENG_8_3, 8.3-RELEASE-p5)
|
|
2012-11-22 22:52:15 UTC (RELENG_9, 9.1-PRERELEASE)
|
|
2012-11-22 22:52:15 UTC (RELENG_9_0, 9.0-RELEASE-p5)
|
|
2012-11-22 22:52:15 UTC (RELENG_9_1, 9.1-RC1-p1)
|
|
2012-11-22 22:52:15 UTC (RELENG_9_1, 9.1-RC2-p1)
|
|
2012-11-22 22:52:15 UTC (RELENG_9_1, 9.1-RC3-p1)
|
|
CVE Name: CVE-2012-4445
|
|
|
|
For general information regarding FreeBSD Security Advisories,
|
|
including descriptions of the fields above, security branches, and the
|
|
following sections, please visit <URL:http://security.FreeBSD.org/>.
|
|
|
|
I. Background
|
|
|
|
The hostapd utility is an authenticator for IEEE 802.11 networks. It
|
|
provides full support for WPA/IEEE 802.11i and can also act as an IEEE
|
|
802.1X Authenticator with a suitable backend Authentication Server
|
|
(typically FreeRADIUS).
|
|
|
|
EAP-TLS is the original, standard wireless LAN EAP authentication
|
|
protocol defined in RFC 5216. It uses PKI to secure communication to a
|
|
RADIUS authentication server or another type of authentication server.
|
|
|
|
II. Problem Description
|
|
|
|
The internal authentication server of hostapd does not sufficiently
|
|
validate the message length field of EAP-TLS messages.
|
|
|
|
III. Impact
|
|
|
|
A remote attacker could cause the hostapd daemon to abort by sending
|
|
specially crafted EAP-TLS messages, resulting in a Denial of Service.
|
|
|
|
IV. Workaround
|
|
|
|
No workaround is available, but systems not running hostapd are not
|
|
vulnerable.
|
|
|
|
Note that for FreeBSD 8.x systems, the EAP-TLS authentication method
|
|
is not enabled by default. Systems running FreeBSD 8.x are only
|
|
affected when hostapd is built with -DEAP_SERVER and as such, binary
|
|
installations from the official release are not affected.
|
|
|
|
V. Solution
|
|
|
|
Perform one of the following:
|
|
|
|
1) Upgrade your vulnerable system to 8-STABLE or 9-STABLE, or to
|
|
the RELENG_8_3, or RELENG_9_0 security branch dated after the
|
|
correction date.
|
|
|
|
2) To update your vulnerable system via a source code patch:
|
|
|
|
The following patches have been verified to apply to FreeBSD 8.3
|
|
and 9.0 systems.
|
|
|
|
a) Download the relevant patch from the location below, and verify the
|
|
detached PGP signature using your PGP utility.
|
|
|
|
[FreeBSD 8.x]
|
|
# fetch http://security.FreeBSD.org/patches/SA-12:07/hostapd-8.patch
|
|
# fetch http://security.FreeBSD.org/patches/SA-12:07/hostapd-8.patch.asc
|
|
|
|
[FreeBSD 9.x]
|
|
|
|
# fetch http://security.FreeBSD.org/patches/SA-12:07/hostapd.patch
|
|
# fetch http://security.FreeBSD.org/patches/SA-12:07/hostapd.patch.asc
|
|
|
|
b) Execute the following commands as root:
|
|
|
|
# cd /usr/src
|
|
# patch < /path/to/patch
|
|
|
|
Recompile the operating system using buildworld and installworld as
|
|
described in <URL:http://www.FreeBSD.org/handbook/makeworld.html>.
|
|
|
|
3) To update your vulnerable system via a binary patch:
|
|
|
|
Systems running 8.3-RELEASE, 9.0-RELEASE, 9.1-RC1, 9.1-RC2, or 9.1-RC3
|
|
on the i386 or amd64 platforms can be updated via the
|
|
freebsd-update(8) utility:
|
|
|
|
# freebsd-update fetch
|
|
# freebsd-update install
|
|
|
|
VI. Correction details
|
|
|
|
The following list contains the revision numbers of each file that was
|
|
corrected in FreeBSD.
|
|
|
|
Subversion:
|
|
|
|
Branch/path Revision
|
|
- -------------------------------------------------------------------------
|
|
stable/8/ r243417
|
|
releng/8.3/ r243417
|
|
stable/9/ r243417
|
|
releng/9.0/ r243417
|
|
releng/9.1/ r243417
|
|
- -------------------------------------------------------------------------
|
|
|
|
VII. References
|
|
|
|
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4445
|
|
|
|
The latest revision of this advisory is available at
|
|
http://security.FreeBSD.org/advisories/FreeBSD-SA-12:07.hostapd.asc
|
|
-----BEGIN PGP SIGNATURE-----
|
|
Version: GnuPG v1.4.9
|
|
|
|
iEYEARECAAYFAlCuxAUACgkQFdaIBMps37J+uQCdHJDzalbjbBfUaWIvz8pzF7rv
|
|
tw8An0LqlJb/IbdwL6YCbmbG0O/OxJtw
|
|
=dlg7
|
|
-----END PGP SIGNATURE-----
|