Description
The 802.11 network stack in net80211/ieee80211_input.c in MadWifi before 0.9.3.1 allows remote attackers to cause a denial of service (system hang) via a crafted length field in nested 802.3 Ethernet frames in Fast Frame packets, which results in a NULL pointer dereference.
References
- USN-479-1 vendor-advisory
- GLSA-200706-04 vendor-advisory
- 25339 third-party-advisory
- 24114 vdb-entry
- 26083 third-party-advisory
- 25622 third-party-advisory
- SUSE-SR:2007:014 vendor-advisory
- 25763 third-party-advisory
- MDKSA-2007:132 vendor-advisory
- http://madwifi.org/wiki/Security
- 36635 vdb-entry
- 25861 third-party-advisory
- ADV-2007-1919 vdb-entry
- 20070606 FLEA-2007-0021-2: madwifi mailing-list
- madwifi-fastframe-dos(34455) vdb-entry
- http://madwifi.org/ticket/1335