[Forgot Password]
Login  Register Subscribe

23631

 
 

115083

 
 

97147

 
 

909

 
 

78730

 
 

109

Paid content will be excluded from the download.


Download | Alert*
OVAL

CESA-2015:1439 -- centos 6 wpa_supplicant

ID: oval:org.secpod.oval:def:204262Date: (C)2017-04-04   (M)2017-11-08
Class: PATCHFamily: unix




The wpa_supplicant package contains an 802.1X Supplicant with support for WEP, WPA, WPA2 , and various EAP authentication methods. It implements key negotiation with a WPA Authenticator for client stations and controls the roaming and IEEE 802.11 authentication and association of the WLAN driver. An integer underflow flaw, leading to a buffer over-read, was found in the way wpa_supplicant handled WMM Action frames. A specially crafted frame could possibly allow an attacker within Wi-Fi radio range to cause wpa_supplicant to crash. This update includes the following enhancement: * Prior to this update, wpa_supplicant did not provide a way to require the host name to be listed in an X.509 certificate"s Common Name or Subject Alternative Name, and only allowed host name suffix or subject substring checks. This update introduces a new configuration directive, "domain_match", which adds a full host name check. All wpa_supplicant users are advised to upgrade to this updated package, which contains a backported patch to correct this issue and adds this enhancement. After installing this update, the wpa_supplicant service will be restarted automatically.

Platform:
CentOS 6
Product:
wpa_supplicant
Reference:
CESA-2015:1439
CVE-2015-4142
CVE    1
CVE-2015-4142
CPE    26
cpe:/o:centos:centos:6
cpe:/a:w1.fi:wpa_supplicant
cpe:/a:w1.fi:wpa_supplicant:0.7.2
cpe:/a:w1.fi:wpa_supplicant:0.7.0
...

© 2013 SecPod Technologies