oss-security April 2010 archive
Main Archive Page > Month Archives  > oss-security archives
oss-security: [oss-security] CVE request: aircrack-ng EAPOL buff

[oss-security] CVE request: aircrack-ng EAPOL buffer overflow

From: Florian Weimer <fw_at_nospam>
Date: Wed Apr 14 2010 - 09:08:30 GMT
To: oss-security@lists.openwall.com

An exploit for a security vulnerability in aircrack-ng has been
published:

| The tools' code responsible for parsing IEEE802.11-packets assumes the
| self-proclaimed length of a EAPOL-packet to be correct and never to exceed
| a (arbitrary) maximum size of 256 bytes for packets that are part of the
| EAPOL-authentication. [...]

<http://pyrit.googlecode.com/svn/tags/opt/aircrackng_exploit.py>

The fix seems to be fixed in r1676 and r1683:

  <http://trac.aircrack-ng.org/changeset/1676>
  <http://trac.aircrack-ng.org/changeset/1683>