CVE-2012-4445: Buffer Overflow
Published Oct 10, 2012
·Updated
Heap-based buffer overflow in the eapservertlsprocessfragment function in eapservertlscommon.c in the EAP authentication server in hostapd 0.6 through 1.0 allows remote attackers to cause a denial of service (crash or abort) via a small "TLS Message Length" value in an EAP-TLS message with the "More Fragments" flag set.
Affected Software
13 affected components
w1.fi hostapd=0.6.0
w1.fi hostapd=0.6.1
w1.fi hostapd=0.6.2
w1.fi hostapd=0.6.3
w1.fi hostapd=0.6.4
w1.fi hostapd=0.6.5
w1.fi hostapd=0.6.6
w1.fi hostapd=0.6.7
w1.fi hostapd=0.7.0
w1.fi hostapd=0.7.1
w1.fi hostapd=0.7.2
w1.fi hostapd=0.7.3
w1.fi hostapd=1.0
Event History
Oct 10, 2012
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2012-4445?
CVE-2012-4445 has been classified as a moderate severity vulnerability.
2
How do I fix CVE-2012-4445?
To fix CVE-2012-4445, upgrade hostapd to version 1.1 or later.
3
What systems are affected by CVE-2012-4445?
CVE-2012-4445 affects hostapd versions from 0.6.0 to 1.0.
4
What type of attack does CVE-2012-4445 facilitate?
CVE-2012-4445 allows remote attackers to cause a denial of service via specially crafted EAP-TLS messages.
5
What is the impact of exploiting CVE-2012-4445?
Exploiting CVE-2012-4445 can lead to a crash or abort of the hostapd service.