Bug 900611 (CVE-2014-3686) - VUL-0: CVE-2014-3686 wpa_supplicant and hostapd: wpa_cli and hostapd_cli remote command execution issue
Summary: VUL-0: CVE-2014-3686 wpa_supplicant and hostapd: wpa_cli and hostapd_cli remo...
Status: RESOLVED FIXED
Alias: CVE-2014-3686
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Major
Target Milestone: ---
Deadline: 2014-10-21
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/109042/
Whiteboard: maint:released:sle10-sp3:59366 maint:...
Keywords:
Depends on:
Blocks:
 
Reported: 2014-10-10 11:13 UTC by Victor Pereira
Modified: 2016-07-20 22:18 UTC (History)
5 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Victor Pereira 2014-10-10 11:13:01 UTC
CVE-2014-3686

a specially crafted string supplied from a remote device could be supplied to a system() call in wpa_cli or hostapd_cli when running an action script (with the "-a" option), resulting in arbitrary command execution. This issue could also be triggered by an attacker within radio range.

Patches are available from the following:

http://w1.fi/security/2014-1/



References:
http://w1.fi/security/2014-1/
http://www.openwall.com/lists/oss-security/2014/10/09/28
https://bugzilla.redhat.com/show_bug.cgi?id=1151259
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3686
http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-3686.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3686
Comment 1 Swamp Workflow Management 2014-10-10 22:00:15 UTC
bugbot adjusting priority
Comment 3 Ruediger Oertel 2014-10-13 15:05:03 UTC
from the announcement:
wpa_supplicant v2.2 with CONFIG_HS20 build option enabled
we don't have this enabled, which means:
Factory, SLE12, 13.2 are not affected

wpa_supplicant v0.7.2-v2.2 with CONFIG_WPS build option enabled and
operating as WPS Registrar
so 13.1 is potentially affected, just as 12.3

the announcement does not mention versions before 0.7.2 affected,
so sle11-sp2 and sle11-sp1 and sle10 should be out of the game (versions 0.7.1, 0.6.9 and 0.4.8 respectively). Looking at the code in the older version however this looks like the patch would be needed, so we should probably do it there.
Comment 4 Ruediger Oertel 2014-10-13 15:49:56 UTC
(sle11-sp2 and later)
# osc sr SUSE:SLE-11-SP2:Update:Test
created request id 45376
(sle11-sp1 and teradata)
# osc sr SUSE:SLE-11-SP1:Update:Test
created request id 45377
(sle10-sp3 and teradata)
# osc sr SUSE:SLE-10-SP3:Update:Test
created request id 45380

(openSUSE 13.1)
# osc sr
WARNING:
WARNING: Project does not accept submit request, request to open a NEW maintenance incident instead
WARNING:
created request id Request: #255857

(openSUSE 12.3)
WARNING:
WARNING: Project does not accept submit request, request to open a NEW maintenance incident instead
WARNING:
created request id Request: #255858
Comment 6 Bernhard Wiedemann 2014-10-13 16:00:06 UTC
This is an autogenerated message for OBS integration:
This bug (900611) was mentioned in
https://build.opensuse.org/request/show/255857 13.1 / wpa_supplicant
https://build.opensuse.org/request/show/255858 12.3 / wpa_supplicant
Comment 7 Swamp Workflow Management 2014-10-14 09:54:06 UTC
An update workflow for this issue was started.
This issue was rated as important.
Please submit fixed packages until 2014-10-21.
When done, reassign the bug to security-team@suse.de.
https://swamp.suse.de/webswamp/wf/59364
Comment 8 Swamp Workflow Management 2014-10-22 13:04:52 UTC
openSUSE-SU-2014:1313-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 900611
CVE References: CVE-2014-3686
Sources used:
openSUSE 12.3 (src):    wpa_supplicant-1.1-2.4.1
Comment 9 Swamp Workflow Management 2014-10-22 13:05:05 UTC
openSUSE-SU-2014:1314-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 900611
CVE References: CVE-2014-3686
Sources used:
openSUSE 13.1 (src):    wpa_supplicant-2.0-3.8.1
Comment 10 Swamp Workflow Management 2014-11-04 21:05:09 UTC
SUSE-SU-2014:1356-1: An update that solves one vulnerability and has one errata is now available.

Category: security (important)
Bug References: 868937,900611
CVE References: CVE-2014-3686
Sources used:
SUSE Linux Enterprise Server 11 SP3 for VMware (src):    wpa_supplicant-0.7.1-6.15.1
SUSE Linux Enterprise Server 11 SP3 (src):    wpa_supplicant-0.7.1-6.15.1
SUSE Linux Enterprise Desktop 11 SP3 (src):    wpa_supplicant-0.7.1-6.15.1
Comment 12 Ruediger Oertel 2014-11-07 09:26:11 UTC
reaasigning
Comment 13 Johannes Segitz 2014-11-11 16:20:46 UTC
released everything
Comment 18 Swamp Workflow Management 2015-06-09 08:05:09 UTC
SUSE-SU-2015:1013-1: An update that fixes three vulnerabilities is now available.

Category: security (moderate)
Bug References: 900611,915323,927558
CVE References: CVE-2014-3686,CVE-2015-0210,CVE-2015-1863
Sources used:
SUSE Linux Enterprise Server 12 (src):    wpa_supplicant-2.2-8.1
SUSE Linux Enterprise Desktop 12 (src):    wpa_supplicant-2.2-8.1