CVE-2015-4145: Medium severity hostapd vulnerability
Published Jun 15, 2015
·Updated
The EAP-pwd server and peer implementation in hostapd and wpasupplicant 1.0 through 2.4 does not validate a fragment is already being processed, which allows remote attackers to cause a denial of service (memory leak) via a crafted message.
Affected Software
17 affected componentsFixes available
debian/wpa
2:2.7+git20190128+0c1e29f-6+deb10u32:2.9.0-212:2.10-122:2.10-15
w1.fi hostapd=1.0
w1.fi hostapd=1.1
w1.fi hostapd=2.0
w1.fi hostapd=2.1
w1.fi hostapd=2.2
w1.fi hostapd=2.3
w1.fi hostapd=2.4
openSUSE openSUSE=13.1
openSUSE openSUSE=13.2
w1.fi Wpa Supplicant=1.0
w1.fi Wpa Supplicant=1.1
w1.fi Wpa Supplicant=2.0
w1.fi Wpa Supplicant=2.1
w1.fi Wpa Supplicant=2.2
w1.fi Wpa Supplicant=2.3
w1.fi Wpa Supplicant=2.4
Event History
Jun 15, 2015
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-4145?
CVE-2015-4145 has been classified as a denial of service vulnerability due to a memory leak.
2
How do I fix CVE-2015-4145?
To fix CVE-2015-4145, upgrade to hostapd and wpa_supplicant versions that are later than 2.4.
3
Which versions of hostapd are affected by CVE-2015-4145?
Hostapd versions 1.0 through 2.4 are affected by CVE-2015-4145.
4
Which versions of wpa_supplicant are vulnerable to CVE-2015-4145?
Wpa_supplicant versions 1.0 through 2.4 are vulnerable to CVE-2015-4145.
5
Can CVE-2015-4145 cause system downtime?
Yes, CVE-2015-4145 can lead to system downtime due to denial of service triggered by crafted messages.