what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

marvell-overflow.txt

marvell-overflow.txt
Posted Sep 4, 2008
Authored by Laurent Butti, Julien Tinnes

The Netgear WN802T (firmware 1.3.16) with the MARVELL 88W8361P-BEM1 chipset suffers from an overflow vulnerability when parsing malformed EAPoL-Key packets.

tags | advisory, overflow
advisories | CVE-2008-1144
SHA-256 | 38d2065be0b8a4aeb8224079f08d4c79ba5ac17ce0b4e9162721a30007efe569

marvell-overflow.txt

Change Mirror Download
Title:
------
* Marvell Driver EAPoL-Key Length Overflow

Summary:
--------
* The wireless drivers in some Wi-Fi access points (such as the
MARVELL-based Netgear WN802T) do not correctly parse malformed EAPoL-Key
packets. This packet is used for unicast/multicast key derivation (which
are called 4-way handshake and group key handshake) of any secure
wireless connection (WPA-PSK, WPA2-PSK, WPA-EAP, WPA2-EAP).

Assigned CVE:
-------------
* CVE-2008-1144

Details:
--------
* The bug can be triggered by a malicious EAPoL-Key packet sent to the
wireless access point (this packet has an advertised length too long
triggering the overflow). This can be achieved only after a successful
802.11 authentication (in "Open" mode according to the configuration of
the wireless access point) and a successful 802.11 association with
appropriate security parameters (e.g. WPA w/ TKIP unicast, TKIP
multicast) which depends on the configuration of the wireless access point.

Attack Impact:
--------------
* Denial-of-service (reboot or hang-up) and possibly remote arbitrary
code execution

Attack Vector:
--------------
* Unauthenticated wireless device for WPA/WPA2-PSK and EAP-based
authenticated wireless device for WPA/WPA2-EAP

Timeline:
---------
* 2008-02-19 - Vulnerability reported Netgear
* 2008-03-06 - PoC sent to Netgear
* 2008-09-04 - Public disclosure

Affected Products:
------------------
* Netgear WN802T (firmware 1.3.16) with MARVELL 88W8361P-BEM1 chipset

Vulnerable Devices:
-------------------
* As it is a wireless driver specific issue, the wireless vendor should
use the latest chipset wireless driver for their access point firmwares.
This security vulnerability was reported to Netgear, updated firmwares
should be available on their web site. Any other wireless device relying
on this vulnerable wireless driver is likely to be vulnerable.

Credits:
--------
* This vulnerability was discovered by Laurent Butti and Julien Tinnes
from France Telecom / Orange
Login or Register to add favorites

File Archive:

July 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    27 Files
  • 2
    Jul 2nd
    10 Files
  • 3
    Jul 3rd
    35 Files
  • 4
    Jul 4th
    27 Files
  • 5
    Jul 5th
    18 Files
  • 6
    Jul 6th
    0 Files
  • 7
    Jul 7th
    0 Files
  • 8
    Jul 8th
    28 Files
  • 9
    Jul 9th
    44 Files
  • 10
    Jul 10th
    24 Files
  • 11
    Jul 11th
    25 Files
  • 12
    Jul 12th
    11 Files
  • 13
    Jul 13th
    0 Files
  • 14
    Jul 14th
    0 Files
  • 15
    Jul 15th
    28 Files
  • 16
    Jul 16th
    6 Files
  • 17
    Jul 17th
    34 Files
  • 18
    Jul 18th
    6 Files
  • 19
    Jul 19th
    0 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close