UBUNTU-CVE-2015-4145

Dashboard / Vulnerabilities / UBUNTU-CVE-2015-4145

UBUNTU-CVE-2015-4145

Summary:

Details: The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 does not validate a fragment is already being processed, which allows remote attackers to cause a denial of service (memory leak) via a crafted message.

References: https://ubuntu.com/security/CVE-2015-4145, http://w1.fi/security/2015-4/, http://w1.fi/security/2015-4/eap-pwd-missing-payload-length-validation.txt, http://w1.fi/security/2015-4/0003-EAP-pwd-peer-Fix-Total-Length-parsing-for-fragment-r.patch, http://w1.fi/security/2015-4/0004-EAP-pwd-server-Fix-Total-Length-parsing-for-fragment.patch, http://www.openwall.com/lists/oss-security/2015/05/07/5, http://www.openwall.com/lists/oss-security/2015/05/31/6, https://ubuntu.com/security/notices/USN-2650-1, https://www.cve.org/CVERecord?id=CVE-2015-4145