4

I'm on Debian jessie the stable release. I noticed that version of wpa_supplicant is vulnerable to DoS attacks according to CVE-2015-8041:

Multiple integer overflows in the NDEF record parser in hostapd before 2.5 and wpa_supplicant before 2.5 allow remote attackers to cause a denial of service (process crash or infinite loop) via a large payload length field value in an (1) WPS or (2) P2P NFC NDEF record, which triggers an out-of-bounds read.

On the stable release the available version is wpa_supplicant 2.3, with a regular sources.list it's not possible to upgrade the current version to wpa_supplicant 2.5 , Why does Debian stable keep some obsolete (vulnerable) packages?

19

Debian has security tracker which shows status of the CVE's in all supported releases. Here is your:

https://security-tracker.debian.org/tracker/CVE-2015-8041

You can check it is fixed in version 2.3-1+deb8u3. The fix was probably backported to the older version, which prevents breaking other things with rebase to new version in stable release (point of stable release).

  • 1
    Amusing naming. If there were a release called 2.3-1+deb8u9, I'd think it just a debug release that somehow got into production. – Dewi Morgan Apr 24 '16 at 0:40
  • 1
    Deb in this place is from Debian and not from Debug :-) – Jakuje Apr 24 '16 at 8:08
2

A bug that allow a remote individual to crash the software (DoS) isn't exactly at the same level of risk as what we normally think of when we talk about "vulnerabilities". I wouldn't call this a "vulnerable" package; otherwise, you're elevating any bug that can cause the program to crash to a security "vulnerability".

Also, it's not clear to me whether this is actually exploitable on any real Debian system. See the comments in https://w1.fi/security/2015-5/incomplete-wps-and-p2p-nfc-ndef-record-payload-length-validation.txt and http://www.openwall.com/lists/oss-security/2015/11/02/5:

Note: No NFC stack implementation has yet been identified with capability to pass the malformed NDEF record to hostapd/wpa_supplicant. As such, it is not known whether this issue can be triggered in practice.

As always, security is about risk management. The level of risk due to this bug sounds pretty low to me.

  • This is certainly a good point to note that it might not be so serious issue in someone's sight. And this is why we have possibility to update or not, when we type apt-get upgrade. – Jakuje Apr 23 '16 at 22:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.