CVE-2015-5316 - The eap_pwd_perform_confirm_exchange function in eap_peer/eap_pwd.c in wpa_supplicant 2.x before 2.6

CVE-2015-5316

Summary

The eap_pwd_perform_confirm_exchange function in eap_peer/eap_pwd.c in wpa_supplicant 2.x before 2.6, when EAP-pwd is enabled in a network configuration profile, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an EAP-pwd Confirm message followed by the Identity exchange.

References

Vulnerable Configurations

cpe:2.3:a:w1.fi:wpa_supplicant:2.0:*:*:*:*:*:*:*
cpe:2.3:a:w1.fi:wpa_supplicant:2.0:*:*:*:*:*:*:*
cpe:2.3:a:w1.fi:wpa_supplicant:2.0-16:*:*:*:*:*:*:*
cpe:2.3:a:w1.fi:wpa_supplicant:2.0-16:*:*:*:*:*:*:*
cpe:2.3:a:w1.fi:wpa_supplicant:2.1:*:*:*:*:*:*:*
cpe:2.3:a:w1.fi:wpa_supplicant:2.1:*:*:*:*:*:*:*
cpe:2.3:a:w1.fi:wpa_supplicant:2.2:*:*:*:*:*:*:*
cpe:2.3:a:w1.fi:wpa_supplicant:2.2:*:*:*:*:*:*:*
cpe:2.3:a:w1.fi:wpa_supplicant:2.3:*:*:*:*:*:*:*
cpe:2.3:a:w1.fi:wpa_supplicant:2.3:*:*:*:*:*:*:*
cpe:2.3:a:w1.fi:wpa_supplicant:2.4:*:*:*:*:*:*:*
cpe:2.3:a:w1.fi:wpa_supplicant:2.4:*:*:*:*:*:*:*
cpe:2.3:a:w1.fi:wpa_supplicant:2.5:*:*:*:*:*:*:*
cpe:2.3:a:w1.fi:wpa_supplicant:2.5:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

CVSS

Base:	4.3 (as of 21-03-2018 - 13:06)
Impact:
Exploitability:

CWE

CWE-476

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
NONE	NONE	PARTIAL

cvss-vector via4

AV:N/AC:M/Au:N/C:N/I:N/A:P

refmap via4

bid	77538
confirm	http://w1.fi/security/2015-8/eap-pwd-unexpected-confirm.txt
debian	DSA-3397
mlist	[oss-security] 20151110 wpa_supplicant: EAP-pwd peer error path failure on unexpected Confirm message
ubuntu	USN-2808-1

Last major update

21-03-2018 - 13:06

Published

21-02-2018 - 16:29

Last modified

21-03-2018 - 13:06