|
|
|
|
| |
Credit:
The information has been provided by Laurent Butti and Julien Tinnes.
|
| |
Vulnerable Systems:
* Netgear WN802T (firmware 1.3.16) with MARVELL 88W8361P-BEM1 chipset
The bug can be triggered by a malicious EAPoL-Key packet sent to the wireless access point (this packet has an advertised length too long triggering the overflow). This can be achieved only after a successful 802.11 authentication (in "Open" mode according to the configuration of the wireless access point) and a successful 802.11 association with appropriate security parameters (e.g. WPA w/ TKIP unicast, TKIP multicast) which depends on the configuration of the wireless access point.
Attack Impact:
Denial-of-service (reboot or hang-up) and possibly remote arbitrary code execution
Attack Vector:
Unauthenticated wireless device for WPA/WPA2-PSK and EAP-based authenticated wireless device for WPA/WPA2-EAP
CVE Information:
CVE-2008-1144
|
|
|
|
|
