Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 496
Alerts This Week
Warning Icon 1 496

Ubuntu 14.04 ESM USN-4734-2 Moderate: wpa_supplicant and hostapd DoS Risks

ubuntu
Calendar Grey February 16, 2021
Dist Ubuntu Esm H88
Addresses multiple vulnerabilities in wpa_supplicant and hostapd impacting Ubuntu installations. Critical update needed for enhanced system security.
Several security issues were fixed in wpa_supplicant and hostapd.

Summary

Several security issues were fixed in wpa_supplicant and hostapd.

Software Description:

- wpa: client support for WPA and WPA2

Details:

USN-4734-1 fixed several vulnerabilities in wpa_supplicant. This

update provides the corresponding update for Ubuntu 14.04 ESM.

It was discovered that wpa_supplicant did not properly handle P2P

(Wi-Fi Direct) group information in some situations, leading to a

heap overflow. A physically proximate attacker could use this to cause a

denial of service or possibly execute arbitrary code. (CVE-2021-0326)

It was discovered that hostapd did not properly handle UPnP subscribe

messages in some circumstances. An attacker could use this to cause a

denial of service. (CVE-2020-12695)

Topics%20covered

Topics Covered

security advisory denial of service security issue Ubuntu heap overflow wpa_supplicant hostapd

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 ESM:
  hostapd                         1:2.1-0ubuntu1.7+esm3
  wpasupplicant                   2.1-0ubuntu1.7+esm3

After a standard system update you need to reboot your computer to make
all the necessary changes.

References

https://ubuntu.com/security/notices/USN-4734-2

https://ubuntu.com/security/notices/USN-4734-1

CVE-2020-12695, CVE-2021-0326

Severity
important
Lowest
Low
Medium
High
Critical

February 16, 2021

Topics%20covered

Topics Covered

security advisory denial of service security issue Ubuntu heap overflow wpa_supplicant hostapd

Package Information

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.