Package: rt73 Severity: critical Tags: security, upstream "Aviv" <spring...@gmail.com> wrote on Bugtraq: > Some Ralinktech wireless cards drivers are suffer from integer > overflow. by sending malformed 802.11 Probe Request packet with no > care about victim's MAC\BSS\SSID can cause to remote code execution in > kernel mode. > > In order to exploit this issue, the attacker should send a Probe > Request packet with SSID length bigger then 128 bytes (but less then > 256) when the victim's card is in ADHOC mode. attacker shouldn't be > on the same network nor even know the MAC\BSS\SSID, he can just send > it broadcast. > > Tested on Ralink USB wireless adapter (RT73) V3.08 on win2k with the > latest driver version.
(Archived at <http://archives.neohapsis.com/archives/bugtraq/2009-01/0167.html>.) No CVE number appears to have been assigned to this yet. Ralink's Linux drivers are based on their Windows drivers and the following code in PeerProbeReqSanity() in the source file sanity.c appears to have exactly this flaw: if ((pFrame->Octet[0] != IE_SSID) || (pFrame->Octet[1] > MAX_LEN_OF_SSID)) { DBGPRINT(RT_DEBUG_TRACE, "PeerProbeReqSanity fail - wrong SSID IE(Type=%d,Len=%d)\n",pFrame->Octet[0],pFrame->Octet[1]); return FALSE; } *pSsidLen = pFrame->Octet[1]; memcpy(Ssid, &pFrame->Octet[2], *pSsidLen); pFrame->Octet is an array of signed char and MAX_LEN_OF_SSID expands to a decimal literal which will have type int. Therefore unsigned values in the range [128, 255] will be treated as values in the range [-128, -1] and will pass the test. Similar code exists in the rt2400, rt2500, rt2570, rt61 and rt2860 drivers. Ben. -- To UNSUBSCRIBE, email to debian-bugs-rc-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
