-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                         ESB-2006.0903 -- [Linux]
   Linux "madwifi" Atheros wireless driver buffer overflow vulnerability
                             12 December 2006

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:              Madwifi driver
Publisher:            US-CERT
Operating System:     Linux variants
Impact:               Root Compromise
Access:               Remote/Unauthenticated
CVE Names:            CVE-2006-6332

Original Bulletin:    http://www.kb.cert.org/vuls/id/925529

- --------------------------BEGIN INCLUDED TEXT--------------------

US-CERT Vulnerability Note VU#925529
Madwifi wireless driver buffer overflow vulnerability

Overview

	A buffer overflow vulnerability exists in the Madwifi wireless driver.
	If successfully exploited, an attacker may be able to execute arbitrary
	code, or cause a denial-of-service condition.

I. Description

	The Madwifi driver is a Linux kernel device driver for Atheros-based
	802.11 a/b/g compatible wireless LAN adapters. Linux distributions
	may include the Madwifi driver in their default installation, or as
	an optional package. Commercial access points and networking equipment
	may also use the Madwifi driver.

	A buffer overflow vulnerability has been discovered in the Madwifi
	driver. This overflow occurs because the driver does not properly
	process the information element part of probe response management
	frames. An attacker within radio range may be able to trigger the
	overflow by sending a specially-crafted 802.11 management frame to a
	vulnerable system. Since 802.11b and 802.11g management frames are
	not encrypted or authenticated, using wireless encryption (WEP/WPA)
	does not mitigate this vulnerability.

	This vulnerability, and the patch, are documented in Madwifi's Changeset
	1842: http://madwifi.org/changeset/1842

II. Impact

	A remote, unauthenticated attacker within 802.11 radio range may be
	able to execute arbitrary code with kernel privileges, or cause a
	denial-of-service condition.

III. Solution

	Upgrade
	The madwifi team has released an upgrade that addresses this issue.
	http://madwifi.org/wiki/news/20061207/release-0-9-2-1-fixes-critical-security-issue
	Users who do not compile their kernel from source should see the
	systems affected portion of this document for information about
	specific vendors.

Systems Affected

	Vendor	Status	Date Updated
	Conectiva Inc.	Unknown	8-Dec-2006
	Debian GNU/Linux	Not Vulnerable	11-Dec-2006
	Engarde Secure Linux	Unknown	8-Dec-2006
	Fedora Project	Not Vulnerable	11-Dec-2006
	Gentoo Linux	Vulnerable	11-Dec-2006
	Hewlett-Packard Company	Unknown	8-Dec-2006
	IBM Corporation (zseries)	Unknown	8-Dec-2006
	IBM eServer	Unknown	8-Dec-2006
	Immunix Communications, Inc.	Unknown	8-Dec-2006
	Ingrian Networks, Inc.	Unknown	8-Dec-2006
	MadWifi	Vulnerable	8-Dec-2006
	Mandriva, Inc.	Unknown	8-Dec-2006
	MontaVista Software, Inc.	Unknown	8-Dec-2006
	Novell, Inc.	Unknown	8-Dec-2006
	Openwall GNU/*/Linux	Not Vulnerable	11-Dec-2006
	Red Hat, Inc.	Not Vulnerable	11-Dec-2006
	Slackware Linux Inc.	Unknown	8-Dec-2006
	Sun Microsystems, Inc.	Unknown	8-Dec-2006
	SUSE Linux	Unknown	8-Dec-2006
	The SCO Group	Unknown	8-Dec-2006
	Trustix Secure Linux	Unknown	8-Dec-2006
	Turbolinux	Unknown	8-Dec-2006
	Ubuntu	Unknown	8-Dec-2006

References

	http://secunia.com/advisories/23277/
	http://madwifi.org/wiki/news/20061207...0-9-2-1-fixes-critical-security-issue
	http://madwifi.org/changeset/1842
	http://lists.immunitysec.com/pipermail/dailydave/2006-December/003888.html

Credit

	Thanks to the Madwifi Team for providing information about this vulnerability.

	This document was written by Ryan Giobbi.
	Other Information
	Date Public	12/07/2006
	Date First Published	12/08/2006 01:33:50 PM
	Date Last Updated	12/11/2006
	CERT Advisory	 
	CVE Name	CVE-2006-6332
	Metric	0.26
	Document Revision	28

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBRX5JrSh9+71yA2DNAQJ7RwP/ftVaZyWyFxZaCjP5smmFHJTd+tuIxueL
TsFnaAE2n9ZKYR0cajlGVq4hD2VmRcjpwc9nChxDb9n2ZSxNdpLshM8g9nxEUxho
vN6dX5jSs8fTQSX9PZA949Eun4smvmg0P/Q1evjRiMUxWHELEGtCykMYRWiXI/Oo
GmK+bwoQudQ=
=TTB8
-----END PGP SIGNATURE-----