Sign-up

ID

VAR-201310-0002


CVE

CVE-2010-1159


TITLE

Aircrack-ng EAPOL Packet Processing Buffer Overflow Vulnerability

Trust: 0.9

sources: BID: 39045 // CNNVD: CNNVD-201310-560

DESCRIPTION

Multiple heap-based buffer overflows in Aircrack-ng before 1.1 allow remote attackers to cause a denial of service (crash) and execute arbitrary code via a (1) large length value in an EAPOL packet or (2) long EAPOL packet. Aircrack-ng is a wireless crack attack tool. Aircrack-ng handles EAPOL messages with boundary errors. When a specially constructed wireless message is submitted to aircrack-ng or airedump-ng is used to open a specially constructed message capture file, a heap-based buffer overflow can be triggered. Successful exploitation of a vulnerability can execute arbitrary instructions with application privileges. Aircrack-ng is prone to a buffer-overflow vulnerability. Failed attacks will likely cause denial-of-service conditions. ---------------------------------------------------------------------- Secunia CSI + Microsoft SCCM ----------------------- = Extensive Patch Management http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ ---------------------------------------------------------------------- TITLE: Aircrack-ng EAPOL Parsing Buffer Overflow Vulnerability SECUNIA ADVISORY ID: SA39150 VERIFY ADVISORY: http://secunia.com/advisories/39150/ DESCRIPTION: Lukas Lueg has reported a vulnerability in Aircrack-ng, which can be exploited by malicious people to potentially compromise a user's system. The vulnerability is caused due to a boundary error in the processing of EAPOL packets. This can be exploited to cause a heap-based buffer overflow via e.g. SOLUTION: Do not process untrusted data using the Aircrack-ng tools. PROVIDED AND/OR DISCOVERED BY: Lukas Lueg ORIGINAL ADVISORY: http://pyrit.googlecode.com/svn/tags/opt/aircrackng_exploit.py ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201310-06 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Aircrack-ng: User-assisted execution of arbitrary code Date: October 07, 2013 Bugs: #311797 ID: 201310-06 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== A buffer overflow vulnerability in Aircrack-ng could result in execution of arbitrary code or Denial of Service. Background ========== Aircrack-ng is an 802.11 WEP and WPA-PSK keys cracking program that can recover keys once enough data packets have been captured. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-wireless/aircrack-ng < 1.1-r2 >= 1.1-r2 Description =========== A buffer overflow vulnerability has been discovered in Aircrack-ng. Workaround ========== There is no known workaround at this time. Resolution ========== All Aircrack-ng users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=net-wireless/aircrack-ng-1.1-r2" References ========== [ 1 ] CVE-2010-1159 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1159 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-201310-06.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2013 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 . _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1159 http://advisories.mageia.org/MGASA-2013-0307.html _______________________________________________________________________ Updated Packages: Mandriva Business Server 1/X86_64: 746eb2a4209b308b4a8fd77518f540e1 mbs1/x86_64/aircrack-ng-1.1-5.1.mbs1.x86_64.rpm df9505748ad1c627a1ee101bc478ab33 mbs1/SRPMS/aircrack-ng-1.1-5.1.mbs1.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/en/support/security/advisories/ If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iD8DBQFSYNQAmqjQ0CJFipgRAtfPAKCcTsBxz3mP0w8xnyUicJdv7FBVVwCg7VQu S4oGoEhYNfQCG/SkLo8CEeA= =nq84 -----END PGP SIGNATURE-----

Trust: 2.79

sources: NVD: CVE-2010-1159 // JVNDB: JVNDB-2010-005653 // CNVD: CNVD-2010-0470 // BID: 39045 // VULMON: CVE-2010-1159 // PACKETSTORM: 87821 // PACKETSTORM: 123518 // PACKETSTORM: 123676

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2010-0470

AFFECTED PRODUCTS

vendor:aircrack ngmodel:aircrack-ngscope:eqversion:1.0

Trust: 1.4

vendor:aircrack ngmodel:aircrack-ngscope:eqversion:0.1

Trust: 1.1

vendor:aircrack ngmodel:aircrack-ngscope:eqversion:0.2

Trust: 1.1

vendor:aircrack ngmodel:aircrack-ngscope:eqversion:0.2.1

Trust: 1.1

vendor:aircrack ngmodel:aircrack-ngscope:eqversion:0.3

Trust: 1.1

vendor:aircrack ngmodel:aircrack-ngscope:eqversion:0.4

Trust: 1.1

vendor:aircrack ngmodel:aircrack-ngscope:eqversion:0.4.1

Trust: 1.1

vendor:aircrack ngmodel:aircrack-ngscope:eqversion:0.4.2

Trust: 1.1

vendor:aircrack ngmodel:aircrack-ngscope:eqversion:0.4.3

Trust: 1.1

vendor:aircrack ngmodel:aircrack-ngscope:eqversion:0.4.4

Trust: 1.1

vendor:aircrack ngmodel:aircrack-ngscope:eqversion:0.5

Trust: 1.1

vendor:aircrack ngmodel:aircrack-ngscope:eqversion:0.6

Trust: 1.1

vendor:aircrack ngmodel:aircrack-ngscope:eqversion:0.6.1

Trust: 1.1

vendor:aircrack ngmodel:aircrack-ngscope:eqversion:0.6.2

Trust: 1.1

vendor:aircrack ngmodel:aircrack-ngscope:eqversion:0.7

Trust: 1.1

vendor:aircrack ngmodel:aircrack-ngscope:eqversion:0.8

Trust: 1.1

vendor:aircrack ngmodel:aircrack-ngscope:eqversion:0.9

Trust: 1.1

vendor:aircrack ngmodel:aircrack-ngscope:eqversion:0.9.1

Trust: 1.1

vendor:aircrack ngmodel:aircrack-ngscope:eqversion:0.9.2

Trust: 1.1

vendor:aircrack ngmodel:aircrack-ngscope:eqversion:0.9.3

Trust: 1.1

vendor:gentoomodel:linuxscope:eqversion:*

Trust: 1.1

vendor:aircrack ngmodel:aircrack-ngscope:lteversion:1.0

Trust: 1.0

vendor:gentoomodel:linuxscope: - version: -

Trust: 0.9

vendor:aircrack ngmodel:aircrack-ngscope:ltversion:1.1

Trust: 0.8

vendor:gentoo linuxmodel:gentoo linuxscope:ltversion:1.1-r2

Trust: 0.8

vendor:nomodel: - scope: - version: -

Trust: 0.6

sources: CNVD: CNVD-2010-0470 // VULMON: CVE-2010-1159 // BID: 39045 // JVNDB: JVNDB-2010-005653 // CNNVD: CNNVD-201310-560 // NVD: CVE-2010-1159

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2010-1159
value: MEDIUM

Trust: 1.0

NVD: CVE-2010-1159
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201310-560
value: MEDIUM

Trust: 0.6

VULMON: CVE-2010-1159
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2010-1159
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

sources: VULMON: CVE-2010-1159 // JVNDB: JVNDB-2010-005653 // CNNVD: CNNVD-201310-560 // NVD: CVE-2010-1159

PROBLEMTYPE DATA

problemtype:CWE-119

Trust: 1.8

sources: JVNDB: JVNDB-2010-005653 // NVD: CVE-2010-1159

THREAT TYPE

remote

Trust: 0.7

sources: PACKETSTORM: 123676 // CNNVD: CNNVD-201310-560

TYPE

buffer overflow

Trust: 0.6

sources: CNNVD: CNNVD-201310-560

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2010-005653

EXPLOIT AVAILABILITY
sources:
            
            
            VULMON: CVE-2010-1159

PATCH
title:ChangeLogurl:http://svn.aircrack-ng.org/trunk/ChangeLog
Trust: 0.8
title:GLSA 201310-06url:http://www.gentoo.org/security/en/glsa/glsa-201310-06.xml
Trust: 0.8
title:LinuxFlawurl:https://github.com/mudongliang/LinuxFlaw 
Trust: 0.1
title:cve-url:https://github.com/oneoy/cve- 
Trust: 0.1
sources:
            
            
            VULMON: CVE-2010-1159 // 
            
            
            
            JVNDB: JVNDB-2010-005653

EXTERNAL IDS
db:NVDid:CVE-2010-1159
Trust: 3.0
db:SECUNIAid:39150
Trust: 2.4
db:SECUNIAid:55053
Trust: 1.7
db:BIDid:39045
Trust: 1.0
db:JVNDBid:JVNDB-2010-005653
Trust: 0.8
db:CNVDid:CNVD-2010-0470
Trust: 0.6
db:GENTOOid:GLSA-201310-06
Trust: 0.6
db:CNNVDid:CNNVD-201310-560
Trust: 0.6
db:EXPLOIT-DBid:12217
Trust: 0.1
db:VULMONid:CVE-2010-1159
Trust: 0.1
db:PACKETSTORMid:87821
Trust: 0.1
db:PACKETSTORMid:123518
Trust: 0.1
db:PACKETSTORMid:123676
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2010-0470 // 
            
            
            
            VULMON: CVE-2010-1159 // 
            
            
            
            BID: 39045 // 
            
            
            
            JVNDB: JVNDB-2010-005653 // 
            
            
            
            PACKETSTORM: 87821 // 
            
            
            
            PACKETSTORM: 123518 // 
            
            
            
            PACKETSTORM: 123676 // 
            
            
            
            CNNVD: CNNVD-201310-560 // 
            
            
            
            NVD: CVE-2010-1159

REFERENCES
url:http://pyrit.googlecode.com/svn/tags/opt/aircrackng_exploit.py
Trust: 1.8
url:http://security.gentoo.org/glsa/glsa-201310-06.xml
Trust: 1.8
url:http://secunia.com/advisories/39150
Trust: 1.7
url:http://secunia.com/advisories/55053
Trust: 1.7
url:http://svn.aircrack-ng.org/trunk/changelog
Trust: 1.7
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-1159
Trust: 0.9
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2010-1159
Trust: 0.8
url:http://secunia.com/advisories/39150/
Trust: 0.7
url:http://www.securityfocus.com/bid/39045
Trust: 0.7
url:http://www.aircrack-ng.org/
Trust: 0.3
url:http://pyrit.wordpress.com/2010/03/31/aircrack-ng-still-vulnerable/
Trust: 0.3
url:http://trac.aircrack-ng.org/changeset/1676
Trust: 0.3
url:http://trac.aircrack-ng.org/changeset/1683
Trust: 0.3
url:http://aircrack-ng.blogspot.com/2010/04/monthly-news-april-2010.html
Trust: 0.3
url:http://pyrit.wordpress.com/2010/03/28/remote-exploit-against-aircrack-ng/
Trust: 0.3
url:https://nvd.nist.gov/vuln/detail/cve-2010-1159
Trust: 0.2
url:https://cwe.mitre.org/data/definitions/119.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:https://www.exploit-db.com/exploits/12217/
Trust: 0.1
url:http://secunia.com/advisories/secunia_security_advisories/
Trust: 0.1
url:http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
Trust: 0.1
url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Trust: 0.1
url:http://secunia.com/advisories/about_secunia_advisories/
Trust: 0.1
url:http://creativecommons.org/licenses/by-sa/2.5
Trust: 0.1
url:http://security.gentoo.org/
Trust: 0.1
url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2010-1159
Trust: 0.1
url:https://bugs.gentoo.org.
Trust: 0.1
url:http://www.mandriva.com/en/support/security/
Trust: 0.1
url:http://www.mandriva.com/en/support/security/advisories/
Trust: 0.1
url:http://advisories.mageia.org/mgasa-2013-0307.html
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2010-0470 // 
            
            
            
            VULMON: CVE-2010-1159 // 
            
            
            
            BID: 39045 // 
            
            
            
            JVNDB: JVNDB-2010-005653 // 
            
            
            
            PACKETSTORM: 87821 // 
            
            
            
            PACKETSTORM: 123518 // 
            
            
            
            PACKETSTORM: 123676 // 
            
            
            
            CNNVD: CNNVD-201310-560 // 
            
            
            
            NVD: CVE-2010-1159

CREDITS
Lukas Lueg
Trust: 0.9
sources:
            
            
            BID: 39045 // 
            
            
            
            CNNVD: CNNVD-201310-560

SOURCES
db:CNVDid:CNVD-2010-0470
db:VULMONid:CVE-2010-1159
db:BIDid:39045
db:JVNDBid:JVNDB-2010-005653
db:PACKETSTORMid:87821
db:PACKETSTORMid:123518
db:PACKETSTORMid:123676
db:CNNVDid:CNNVD-201310-560
db:NVDid:CVE-2010-1159

LAST UPDATE DATE
2025-04-11T23:10:39.215000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2010-0470date:2010-03-30T00:00:00
db:VULMONid:CVE-2010-1159date:2013-10-29T00:00:00
db:BIDid:39045date:2013-10-21T01:07:00
db:JVNDBid:JVNDB-2010-005653date:2013-10-30T00:00:00
db:CNNVDid:CNNVD-201310-560date:2013-10-29T00:00:00
db:NVDid:CVE-2010-1159date:2025-04-11T00:51:21.963

SOURCES RELEASE DATE
db:CNVDid:CNVD-2010-0470date:2010-03-30T00:00:00
db:VULMONid:CVE-2010-1159date:2013-10-28T00:00:00
db:BIDid:39045date:2010-03-27T00:00:00
db:JVNDBid:JVNDB-2010-005653date:2013-10-30T00:00:00
db:PACKETSTORMid:87821date:2010-03-30T05:50:49
db:PACKETSTORMid:123518date:2013-10-07T22:30:09
db:PACKETSTORMid:123676date:2013-10-18T20:10:32
db:CNNVDid:CNNVD-201310-560date:2010-03-27T00:00:00
db:NVDid:CVE-2010-1159date:2013-10-28T22:55:03.227