NEWS: Broadcom flaw spawns wireless risk

<http://www.theregister.com/2006/11/15/broadcom_driver_flaw/>

Security researchers have discovered a vulnerability
(http://www.kb.cert.org/vuls/id/209376) in Broadcom wireless
device drivers.

Flaws in handling 802.11 probe responses containing a long SSID
field mean that systems that use the Broadcom BCMWL5.SYS wireless
device driver are left open to buffer overflow attacks. The flaw
might be used by hackers within radio range to inject hostile code
into vulnerable systems. The list of potential targets (Broadcom
partners) is extensive.

The flaw does not lend itself to remote attack across the internet
but it does mean that hackers within radio range (for example when a
user is in the vicinity of a hot spot used by an attacker) might be
able be mount either a denial of service or code injection attack.
Users are advised to turn off their wireless cards when not in use
pending the availability of updates from Broadcom's partners.

The affected driver is bundled with new PCs from Dell, Gateway and
HP among other computer manufacturers. Wireless card manufactures
including Linksys also provide devices that ship with this driver.
...

[MORE]

--
Best regards, FAQ for Wireless Internet: <http://Wireless.wikia.com>
John Navas FAQ for Wi-Fi: <http://wireless.wikia.com/wiki/Wi-Fi>
Wi-Fi How To: <http://wireless.wikia.com/wiki/Wi-Fi_HowTo>
Fixes to Wi-Fi Problems: <http://wireless.wikia.com/wiki/Wi-Fi_Fixes>

John Navas <(E-Mail Removed)> hath wroth:

><http://www.theregister.com/2006/11/15/broadcom_driver_flaw/>
>
> Security researchers have discovered a vulnerability
> (http://www.kb.cert.org/vuls/id/209376) in Broadcom wireless
> device drivers.

Note that Linksys says it only uses the affected driver on one
product, WPC300N:
http://www.kb.cert.org/vuls/id/MAPG-6VGNHW
A fix has already been issued but doesn't list the buffer overflow
problem in the release notes. As mentioned, other drivers and
versions may be affected.


--
Jeff Liebermann (E-Mail Removed)
150 Felker St #D http://www.LearnByDestroying.com
Santa Cruz CA 95060 http://802.11junk.com
Skype: JeffLiebermann AE6KS 831-336-2558