This release fixes three security issues which affect v0.9.3, probably older releases as well. If you use an older version, we highly recommend an update.
- #1270 Beacon Interval may be zero; it is used as a divisor
- #1334 ieee80211_ioctl_getwmmparams local kernel DoS
- #1335 Fast Frame parsing remote kernel DoS]
Same as v0.9.3:
- Various mode changing and scanning related annoyances (#572, #228, #275, #254, #352, #378)
- Suspend state not working properly (#201)
- Countrycode regression in recent HAL versions (#120)
- Stability problems when more than one VAP is in active use (#182, many other tickets)
- MAC address changing currently unsupported (#323) / not working correctly (#716)
- Documentation about private ioctl's and other features not 100% complete (#324, #486, #527, #399)
- No support for AR5008 chipsets available yet (#1001)
We recently have been made aware of three security-related issues in MadWifi v0.9.3. In response to these reports we've released v0.9.3.1 today (which is similar to v0.9.3 plus the relevant fixes). The release tarballs are available for immediate download from: http://sourceforge.net/project/showfiles.php?group_id=82936&package_id=85233
*We strongly advise all users of MadWifi to upgrade to v0.9.3.1 as soon as possible.*
Thanks to Md Sohail Ahmad of AirTight Networks Inc. for reporting issue 1. We also like to thank the reporter of issues 2 and 3, who has asked to keep his identity private.
The issues are:
1. Remote DoS: insufficient input validation (beacon interval)
The beacon interval information that is gathered while scanning for Access Points is not properly validated. This could be exploited from remote to cause a DoS due to a "division by zero" exception.
See also: http://madwifi-project.org/ticket/1270
2. Remote DoS: insufficient input validation (Fast Frame parsing)
The code which parses fast frames and 802.3 frames embedded therein does not properly validate the size parameters in such frames. This could be exploited from remote to cause a DoS due to a NULL-pointer dereference.
See also: http://madwifi-project.org/ticket/1335
3. Local DoS: insufficient input validation (WMM parameters)
A restricted local user could pass invalid data to two ioctl handlers, causing a DoS due to access being made to invalid addresses. Chances are that this issue also might allow read and/or write access to kernel memory; this has not yet been verified.
See also: http://madwifi-project.org/ticket/1334
Thanks for your attention.