USN-3455-1: wpa_supplicant and hostapd vulnerabilities Ubuntu Security Notice USN-3455-1 16th October, 2017 wpa vulnerabilities A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 17.04 Ubuntu 16.04 LTS Ubuntu 14.04 LTS Summary Several security issues were fixed in wpa_supplicant. Software description wpa – client support for WPA and WPA2 Details Mathy Vanhoef discovered that wpa_supplicant and hostapd incorrectlyhandled WPA2. A remote attacker could use this issue with keyreinstallation attacks to obtain sensitive information. (CVE-2017-13077,CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081,CVE-2017-13082, CVE-2017-13086, CVE-2017-13087, CVE-2017-13088) Imre Rad discovered that wpa_supplicant and hostapd incorrectly handledinvalid characters in passphrase parameters. A remote attacker could usethis issue to cause a denial of service. (CVE-2016-4476) Imre Rad discovered that wpa_supplicant and hostapd incorrectly handledinvalid characters in passphrase parameters. A local attacker could usethis issue to cause a denial of service, or possibly execute arbitrarycode. (CVE-2016-4477) Update instructions [ more… ]
