Wireless Vulnerabilities & Exploits
Wireless Vulnerabilities & Exploits
WVE ID: WVE-2006-0060
Type: Vulnerability
Status: Candidate
Classification:
Input Manipulation
Description:
Some wireless drivers utilized by OS X contain a vulnerability allowing remote code execution, which is triggered by malformed 802.11 frames.
Discussion:
At the BlackHat 2006 and Defcon 14 security conferences a vulnerability in the driver used wireless adapters containing Atheros chipsets was discussed. Details of this vulnerability were not initially disclosed due to security reasons. However, the vulnerability was demonstrated to be exploitable and can lead to total system compromise due to the driver's close interaction with the kernel.
The demonstration system used was a MacBook utilizing an Atheros based 802.11 USB adapter. At the time, additional reports suggested that the Apple supplied Airport Extreme, which makes use of an Atheros chipset on x86 Macs, might also be vulnerable to the same issue.
It is doubtful that this issue affects non-x86 Mac products with Airport Extreme due to the use of Broadcom chipsets on those platforms. However, it is possible that similar issues exist on such systems.
Details of the vulnerability demonstrated in 2006 were disclosed by Maynor in September 2007 (see referenced URL). According to Maynor, the vulnerability was found in the Apple driver included with Mac OS X version 10.4.7 on Macbooks and Mac Minis running on an Intel processor. Beacon and probe fuzzing tests uncovered a buffer overflow flaw in the driver's handling of the Extended Rate Information Element. The flaw causes memory corruption that has been shown to permit arbitrary OS X kernel-mode shell code execution on the vulnerable system, allowing an attacker to gain control of that system.
Credits
Author:
David
Maynor
: SecureWorks
Author:
Johnny
Cache
: None
References
URL:
http://blackhat.com/html/bh-usa-06/bh-usa-06-speakers.html#Ellch
URL:
http://uninformed.org/?v=8&a=4
Released: 2006-08-02
Submitter
Andrew
Lockhart
(alockhart@networkchemistry.com)
: Network Chemistry
Submitted: Mon Aug 07 15:41:27 -0700 2006
Candidate Date: Mon Aug 07 15:42:28 -0700 2006
