CVE-2016-4476: Input Validation
Published May 9, 2016
·Updated
hostapd 0.6.7 through 2.5 and wpasupplicant 0.6.7 through 2.5 do not reject \n and \r characters in passphrase parameters, which allows remote attackers to cause a denial of service (daemon outage) via a crafted WPS operation.
Affected Software
5 affected components
w1.fi hostapd>=0.6.7<=2.5
w1.fi Wpa Supplicant>=0.6.7<=2.5
Canonical Ubuntu Linux=14.04
Canonical Ubuntu Linux=16.04
Canonical Ubuntu Linux=17.04
Event History
May 9, 2016
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-4476?
CVE-2016-4476 is classified as a denial of service vulnerability.
2
How do I fix CVE-2016-4476?
To fix CVE-2016-4476, update hostapd or wpa_supplicant to a version above 2.5.
3
Which systems are affected by CVE-2016-4476?
CVE-2016-4476 affects hostapd versions from 0.6.7 to 2.5 and wpa_supplicant versions from 0.6.7 to 2.5.
4
What can exploit CVE-2016-4476?
Remote attackers can exploit CVE-2016-4476 through crafted WPS operations.
5
What are the impacts of CVE-2016-4476?
The impact of CVE-2016-4476 is a daemon outage leading to service disruption.