Description
ieee80211_input.c in MadWifi before 0.9.3 does not properly process Channel Switch Announcement Information Elements (CSA IEs), which allows remote attackers to cause a denial of service (loss of communication) via a Channel Switch Count less than or equal to one, triggering a channel change.
References
- USN-479-1 vendor-advisory
- MDKSA-2007:082 vendor-advisory
- 23436 vdb-entry
- 24670 third-party-advisory
- 24931 third-party-advisory
- 26083 third-party-advisory
- ADV-2007-1187 vdb-entry
- SUSE-SR:2007:014 vendor-advisory
- 34645 vdb-entry
- http://madwifi.org/wiki/Releases/0.9.3
- 24841 third-party-advisory
- http://madwifi.org/ticket/963
- 20070423 FLEA-2007-0012-1: madwifi mailing-list
- GLSA-200704-15 vendor-advisory
- 25861 third-party-advisory
- http://dev.lintrack.org/ticket/101