CVE-2014-3686

A vulnerability was found in the mechanism wpa_cli and hostapd_cli use for executing action scripts. An unsanitized string received from a remote device can be passed to a system() call resulting in arbitrary command execution under the privileges of the wpa_cli/hostapd_cli process (which may be root in common use cases) (CVE-2014-3686).

Using the Mageia wpa_supplicant package, systems are exposed to the vulnerability if operating as a WPS registrar.

The Mageia hostapd package was not vulnerable with the configuration with which it was built, but if a sysadmin had rebuilt it with WPS enabled, it would be vulnerable.

These are all security issues fixed in the hostapd-2.6-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the wpa_supplicant-2.6-1.1 package on the GA media of openSUSE Tumbleweed.

wpa_supplicant was updated to fix three security issues:

• CVE-2015-0210: wpa_supplicant: broken certificate subject check this adds the 'domain_match' config option from upstream (additional to the already existing domain_suffix_match)
• CVE-2014-3686: hostapd command execution
• CVE-2015-1863: P2P SSID processing vulnerability

wpa_supplicant and hostapd 0.7.2 through 2.2, when running with certain configurations and using wpa_cli or hostapd_cli with action scripts, allows remote attackers to execute arbitrary commands via a crafted frame.

Jouni Malinen discovered that the wpa_cli tool incorrectly sanitized strings when being used with action scripts. A remote attacker could possibly use this issue to execute arbitrary commands.