We recently have been made aware of three security-related issues in MadWifi
v0.9.3. In response to these reports we've released v0.9.3.1 today (which is similar to v0.9.3 plus the relevant fixes). The release tarballs are available for immediate download from: http://sourceforge.net/project/showf...ckage_id=85233
*We strongly advise all users of MadWifi
to upgrade to v0.9.3.1 as soon as possible.*
Thanks to Md Sohail Ahmad of AirTight Networks Inc. for reporting issue 1. We also like to thank the reporter of issues 2 and 3, who has asked to keep his identity private.
The issues are:
1. Remote DoS: insufficient input validation (beacon interval)
The beacon interval information that is gathered while scanning for Access Points is not properly validated. This could be exploited from remote to cause a DoS due to a "division by zero" exception.
See also: http://madwifi.org/ticket/1270
2. Remote DoS: insufficient input validation (Fast Frame parsing)
The code which parses fast frames and 802.3 frames embedded therein does not properly validate the size parameters in such frames. This could be exploited from remote to cause a DoS due to a NULL-pointer dereference.
See also: http://madwifi.org/ticket/1335
3. Local DoS: insufficient input validation (WMM parameters)
A restricted local user could pass invalid data to two ioctl handlers, causing a DoS due to access being made to invalid addresses. Chances are that this issue also might allow read and/or write access to kernel memory; this has not yet been verified.
See also: http://madwifi.org/ticket/1334
Thanks for your attention.