drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Zwei Probleme in hostapd
Name: |
Zwei Probleme in hostapd |
|
ID: |
MDVSA-2012:168 |
|
Distribution: |
Mandriva |
|
Plattformen: |
Keine Angabe |
|
Datum: |
Mo, 22. Oktober 2012, 11:42 |
|
Referenzen: |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2389
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4445 |
|
Applikationen: |
hostapd |
|
Originalnachricht |
This is a multi-part message in MIME format...
------------=_1350897003-4618-382
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDVSA-2012:168 http://www.mandriva.com/security/ _______________________________________________________________________
Package : hostapd Date : October 22, 2012 Affected: 2011. _______________________________________________________________________
Problem Description:
Multiple vulnerabilities has been discovered and corrected in hostapd: hostapd 0.7.3, and possibly other versions before 1.0, uses 0644 permissions for /etc/hostapd/hostapd.conf, which might allow local users to obtain sensitive information such as credentials (CVE-2012-2389). Heap-based buffer overflow in the eap_server_tls_process_fragment function in eap_server_tls_common.c in the EAP authentication server in hostapd 0.6 through 1.0 allows remote attackers to cause a denial of service (crash or abort) via a small TLS Message Length value in an EAP-TLS message with the More Fragments flag set (CVE-2012-4445). The updated packages have been patched to correct these issues. _______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2389 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4445 _______________________________________________________________________
Updated Packages:
Mandriva Linux 2011: 8fa9981eaf73dd9e84b62b42e300211a 2011/i586/hostapd-0.7.3-2.3-mdv2011.0.i586.rpm 912f917c8f0d5c8d146d544f9099cc29 2011/SRPMS/hostapd-0.7.3-2.3.src.rpm
Mandriva Linux 2011/X86_64: 4d692e59b6e55c1cc9292315fcc0570a 2011/x86_64/hostapd-0.7.3-2.3-mdv2011.0.x86_64.rpm 912f917c8f0d5c8d146d544f9099cc29 2011/SRPMS/hostapd-0.7.3-2.3.src.rpm _______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com _______________________________________________________________________
Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux)
iD8DBQFQhOGRmqjQ0CJFipgRAnrmAJ9xUxEo/Letga+CB8FLUkohKRRAnQCfeNqC bfTTMhF26NCvFgGKgu6nwEQ= =Cspq -----END PGP SIGNATURE-----
------------=_1350897003-4618-382 Content-Type: text/plain; charset="UTF-8"; name="message-footer.txt" Content-Disposition: inline; filename="message-footer.txt" Content-Transfer-Encoding: 8bit
To unsubscribe, send a email to sympa@mandrivalinux.org with this subject : unsubscribe security-announce _______________________________________________________ Want to buy your Pack or Services from Mandriva? Go to http://www.mandrivastore.com Join the Club : http://www.mandrivaclub.com _______________________________________________________
------------=_1350897003-4618-382--
|
|
|
|