Bugzilla Bug 179532

Some vulnerabilities have been reported in MadWifi, which can be exploited by
malicious, local users and malicious people to cause a DoS (Denial of Service).

1) A division by zero error exists within the function "ath_beacon_config()".
This can be exploited to cause a crash by sending a packet with a zero beacon
interval to a vulnerable system.

2) An input sanitation error exists within the IO control
"ieee80211_ioctl_getwmmparams". This can be exploited to crash the kernel by
calling the IO control with a negative index parameter.

This may also allow certain parts of the memory to be disclosed.

3) An input sanitation error exist within the packet parser when parsing nested
802.3 Ethernet frame lengths. This can be exploited to cause a NULL pointer
dereference by sending a specially crafted fast frame packet to a vulnerable
system.

The vulnerabilities are reported in versions prior to 0.9.3.1.

Solution:
Update to version 0.9.3.1.

Reproducible: Always

maintainers - please provide an updated ebuild

New ebuilds in the tree.

Just a note here:

I just tried the 0.9.3.1 version (I'm using wpa_supplicant) and Firefox keeps
dying after a few minutes of inactivity.  So I've gone back to the "vulnerable"
version till I figure out what is going on. Please don't remove the old version
from the tree too quickly. 

Thx Stefan.

Arches please test and mark stable. Target keywords are:

madwifi-ng-0.9.3.1.ebuild:KEYWORDS="amd64 ppc x86"

(In reply to comment #4)
> Thx Stefan.
> 
> Arches please test and mark stable. Target keywords are:
> 
> madwifi-ng-0.9.3.1.ebuild:KEYWORDS="amd64 ppc x86"
> 

At the moment, it won't pass the collision-test if upgrading because the
headers have been switched being installed from madwifi-ng to madwifi-ng-tools.
 See bug #179348.

net-wireless/madwifi-ng-0.9.3.1 USE="-injection"
1. emerges on x86
2. as mentioned, does not pass collision test
3. works

Portage 2.1.2.7 (default-linux/x86/2007.0/desktop, gcc-4.1.2, glibc-2.5-r2,
2.6.20.11 i686)
=================================================================
System uname: 2.6.20.11 i686 Genuine Intel(R) CPU           T2300  @ 1.66GHz
Gentoo Base System release 1.12.9
Timestamp of tree: Wed, 23 May 2007 17:30:09 +0000
dev-java/java-config: 1.3.7, 2.0.31-r5
dev-lang/python:     2.3.5-r3, 2.4.4-r4
dev-python/pycrypto: 2.0.1-r5
sys-apps/sandbox:    1.2.17
sys-devel/autoconf:  2.13, 2.61
sys-devel/automake:  1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2, 1.10
sys-devel/binutils:  2.16.1-r3
sys-devel/gcc-config: 1.3.16
sys-devel/libtool:   1.5.22
virtual/os-headers:  2.6.17-r2
ACCEPT_KEYWORDS="x86"
AUTOCLEAN="yes"
CBUILD="i686-pc-linux-gnu"
CFLAGS="-O2 -march=prescott -pipe -fomit-frame-pointer"
CHOST="i686-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/kde/3.5/env /usr/kde/3.5/share/config
/usr/kde/3.5/shutdown /usr/share/X11/xkb /usr/share/config"
CONFIG_PROTECT_MASK="/etc/env.d /etc/env.d/java/ /etc/gconf
/etc/java-config/vms/ /etc/php/apache2-php5/ext-active/
/etc/php/cgi-php5/ext-active/ /etc/php/cli-php5/ext-active/ /etc/revdep-rebuild
/etc/terminfo /etc/texmf/web2c"
CXXFLAGS="-O2 -march=prescott -pipe -fomit-frame-pointer"
DISTDIR="/usr/portage/distfiles"
EMERGE_DEFAULT_OPTS="--nospinner"
FEATURES="collision-protect distlocks metadata-transfer parallel-fetch sandbox
sfperms strict test userfetch userpriv usersandbox"
GENTOO_MIRRORS="http://mirror.switch.ch/mirror/gentoo/ http://gentoo.inode.at/"
LINGUAS="en de en_GB de_CH"
MAKEOPTS="-j3"
PKGDIR="/usr/portage/packages"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress
--force --whole-file --delete --delete-after --stats --timeout=180
--exclude=/distfiles --exclude=/local --exclude=/packages
--filter=H_**/files/digest-*"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
SYNC="rsync://rsync.gentoo.org/gentoo-portage"
USE="X a52 aac acl acpi alsa apache2 asf avahi berkdb bitmap-fonts cairo cdr
cdrom cli cracklib crypt cups dbus divx dri dts dvd dvdr dvdread eds emboss
encode evo fam ffmpeg firefox flac fortran gdbm gif gnome gpm gstreamer gtk hal
iconv ipv6 isdnlog java jpeg kde kdeenablefinal kerberos ldap libg++ mad midi
mikmod mmx mono mp3 mpeg mudflap ncurses nls nptl nptlonly ogg opengl openmp
oss pam pcre pdf perl png pppd python qt3 qt3support qt4 quicktime readline
reflection rtsp ruby samba sdl session smp spell spl sse sse2 sse3 ssl svg tcpd
test tetex theora threads tiff truetype truetype-fonts type1-fonts unicode vcd
vorbis wifi win32codecs wxwindows x264 x86 xine xml xorg xprint xv xvid zlib"
ELIBC="glibc" INPUT_DEVICES="keyboard mouse" KERNEL="linux" LINGUAS="en de
en_GB de_CH" USERLAND="GNU" VIDEO_CARDS="i810 fbdev vesa"
Unset:  CTARGET, INSTALL_MASK, LANG, LC_ALL, LDFLAGS, PORTAGE_COMPRESS,
PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS, PORTDIR_OVERLAY

x86 stable, thanks Markus

ppc stable

--amd64--
net-wireless/madwifi-ng-0.9.3.1 USE="-injection kernel_linux"

1: emerges
2: madwifi-ng-tools (DEPEND) does not pass collision-protect (collision with
old madwifi-ng package)
3: works in WEP mode (WPA not available here)

Portage 2.1.2.7 (default-linux/amd64/2007.0/desktop, gcc-4.1.2, glibc-2.5-r3,
2.6.21-gentoo-r1 x86_64)
=================================================================
System uname: 2.6.21-gentoo-r1 x86_64 AMD Athlon(tm) 64 X2 Dual Core Processor
4200+
Gentoo Base System release 1.12.9
Timestamp of tree: Fri, 01 Jun 2007 04:00:04 +0000
ccache version 2.4 [enabled]
dev-java/java-config: 1.3.7, 2.0.32
dev-lang/python:     2.4.4-r4
dev-python/pycrypto: 2.0.1-r5
dev-util/ccache:     2.4-r7
sys-apps/sandbox:    1.2.17
sys-devel/autoconf:  2.13, 2.61
sys-devel/automake:  1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2, 1.10
sys-devel/binutils:  2.16.1-r3
sys-devel/gcc-config: 1.3.16
sys-devel/libtool:   1.5.22
virtual/os-headers:  2.6.17-r2
ACCEPT_KEYWORDS="amd64"
AUTOCLEAN="yes"
CBUILD="x86_64-pc-linux-gnu"
CFLAGS="-O2 -ggdb -march=athlon64 -pipe"
CHOST="x86_64-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/kde/3.5/env /usr/kde/3.5/share/config
/usr/kde/3.5/shutdown /usr/share/X11/xkb /usr/share/config"
CONFIG_PROTECT_MASK="/etc/env.d /etc/env.d/java/ /etc/gconf /etc/init.d
/etc/revdep-rebuild /etc/terminfo /etc/texmf/web2c"
CXXFLAGS="-O2 -ggdb -march=athlon64 -pipe"
DISTDIR="/tmp/portage"
FEATURES="ccache collision-protect distlocks metadata-transfer multilib-strict
parallel-fetch sandbox sfperms splitdebug strict test"
GENTOO_MIRRORS="http://ds.thn.htu.se/linux/gentoo              
http://ftp.belnet.be/mirror/rsync.gentoo.org/gentoo/           
http://ftp-stud.fht-esslingen.de/pub/Mirrors/gentoo/           
http://mirror.switch.ch/mirror/gentoo/         
http://trumpetti.atm.tut.fi/gentoo/"
LANG="en_US.utf-8"
LINGUAS="en sv"
MAKEOPTS="-j4"
PKGDIR="/tmp/packages"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress
--force --whole-file --delete --delete-after --stats --timeout=180
--exclude=/distfiles --exclude=/local --exclude=/packages
--filter=H_**/files/digest-*"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/usr/portage/local/private"
SYNC="rsync://dx/gentoo-portage"
USE="3dnow 3dnowext X a52 aac acpi aiglx alsa amd64 arts asf avi
bash-completion berkdb bitmap-fonts branding browserplugin cairo ccache cdr cli
cpudetection cracklib crypt cscope css cups cvs dbus divx divx4linux dlloader
dri dvd dvdr dvdread eds emboss encode esd evo fam ffmpeg firefox flac
foomaticdb freetype gdbm geoip gif gimp gmedia gnokii gnome gpm gstreamer gtk
hal http iconv ieee1394 imap imlib ipv6 isdnlog java javascript jfs jpeg kde
kdeenablefinal kdehiddenvisibility kdepim kerberos libg++ logitech-mouse mad
madwifi maildir midi mikmod mmx mmx2 mmxext mono mozbranding moznopango mozsvg
mp3 mpeg mplayer msn mudflap ncurses nls nptl nptlonly nsplugin ntfs nvidia
obex ogg oggvorbis opengl openmp oss pam pcre pdf pdflib perl png pppd python
qt qt3 qt3support qt4 quicktime readline realmedia reflection reiserfs samba
scanner sdl session spell spl sse sse2 ssl subversion svg symlink tcpd test
tetex theora threads tiff truetype truetype-fonts type1-fonts udev unicode usb
v4l v4l2 vim-syntax vim-with-x visualization vorbis wifi wmf wmp wxwindows
xcomposite xface xfs xine xinerama xml xorg xosd xpm xprint xv xvid zlib"
ALSA_CARDS="emu10k1" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop
empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mulaw multi
null plug rate route share shm softvol" ELIBC="glibc" INPUT_DEVICES="mouse
keyboard evdev" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780
lb216 lcdm001 mtxorb ncurses text" LINGUAS="en sv" USERLAND="GNU"
VIDEO_CARDS="nv nvidia"
Unset:  CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LC_ALL, LDFLAGS,
PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS

amd64 stable, thanks Togge.

this bug is ready for glsa decision

I tend to vote NO.

It's not about a madwifi DoS, but a whole system crash. I vote Yes for a GLSA.

Thanks for clearing that up. Changing to full YES vote.

There is also execution of code mentioned in it.

GLSA 200706-04, thanks everybody