CVE - CVE-2012-4445

CVE-ID
CVE-2012-4445	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Heap-based buffer overflow in the eap_server_tls_process_fragment function in eap_server_tls_common.c in the EAP authentication server in hostapd 0.6 through 1.0 allows remote attackers to cause a denial of service (crash or abort) via a small "TLS Message Length" value in an EAP-TLS message with the "More Fragments" flag set.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MLIST:[oss-security] 20121008 [PRE-SA-2012-07] hostapd: Missing EAP-TLS message length validation URL:http://www.openwall.com/lists/oss-security/2012/10/08/3 MISC:http://www.pre-cert.de/advisories/PRE-SA-2012-07.txt CONFIRM:http://w1.fi/gitweb/gitweb.cgi?p=hostap.git;a=commitdiff;h=586c446e0ff42ae00315b014924ec669023bd8de DEBIAN:DSA-2557 URL:http://www.debian.org/security/2012/dsa-2557 FREEBSD:FreeBSD-SA-12:07 URL:http://www.freebsd.org/security/advisories/FreeBSD-SA-12:07.hostapd.asc MANDRIVA:MDVSA-2012:168 URL:http://www.mandriva.com/security/advisories?name=MDVSA-2012:168 BID:55826 URL:http://www.securityfocus.com/bid/55826 OSVDB:86051 URL:http://osvdb.org/86051 SECTRACK:1027808 URL:http://www.securitytracker.com/id?1027808 SECUNIA:50805 URL:http://secunia.com/advisories/50805 SECUNIA:50888 URL:http://secunia.com/advisories/50888 XF:hostapd-eaptls-dos(79104) URL:https://exchange.xforce.ibmcloud.com/vulnerabilities/79104
Assigning CNA
N/A
Date Entry Created
20120821	Disclaimer: The entry creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20120821)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an entry on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: cve@mitre.org