CVE-2006-6332
published 2006-12-10CVE-2006-6332: Stack-based buffer overflow in net80211/ieee80211_wireless.c in MadWifi before 0.9.2.1 allows remote attackers to execute arbitrary code via unspecified…
PriorityP356high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
19.68%
97.1th percentile
Stack-based buffer overflow in net80211/ieee80211_wireless.c in MadWifi before 0.9.2.1 allows remote attackers to execute arbitrary code via unspecified vectors, related to the encode_ie and giwscan_cb functions.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| madwifi | madwifi | — | — |
Detection & IOCsextracted from sources · hover to see the quote
otherscan_iterate_ra = 0x8014401 (Ubuntu 6.10 target: return address in ieee80211_scan_iterate in wlan.ko)↗
bytes↗
\xdd + value.length.chr + value (WPA IE overflow: \xdd followed by oversized length and payload)
- →Detect oversized WPA/RSN/WME/Atheros OUI Information Elements in 802.11 beacon frames — the overflow is triggered by a crafted IE where the length field causes a stack buffer overflow in giwscan_cb via memcpy(buf, se->se_wpa_ie, se->se_wpa_ie[1] + 2). ↗
- →Monitor for 802.11 beacon frames containing a WPA IE (tag 0xdd, OUI 00:50:f2:01) with an abnormally large length field (e.g., 0xc6 = 198 bytes) exceeding the expected buffer size. ↗
- →The exploit path is: ieee80211_ioctl_giwscan -> ieee80211_scan_iterate -> sta_iterate -> giwscan_cb; monitor for kernel crashes or unexpected code execution originating from wlan.ko / MadWifi driver context. ↗
- →The vulnerability is triggered by any of these crafted information elements in beacon frames: WPA, RSN, WME, and Atheros OUI. Inspect all four IE types for oversized length fields. ↗
- →Exploit beacons use a fixed SSID IE payload of '\x00\x03\x41\x41\x41' (SSID = 'AAA') and a specific supported-rates IE '\x01\x08\x82\x84\x8b\x96\x0c\x18\x30\x48'; these static bytes can serve as a signature for the PoC exploit traffic. ↗
- →The exploit sends approximately 10 beacon frames per second (usleep(100000)) in a loop of 10,000 iterations; high-rate beacon flooding from a single source with malformed IEs is a detection signal. ↗
- ·The VSYSCALL JMP ESP address 0xffffe777 is valid for Linux kernel 2.6.17; kernels >= 2.6.18 without a fixed vsyscall entry require a hardcoded kernel value instead. ↗
- ·The Metasploit module's 'Generic' target requires a non-randomized vDSO (ASLR disabled) to use the fixed JMPESP address 0xffffe777; randomized vDSO will cause exploitation to fail. ↗
- ·Red Hat Enterprise Linux 2.1, 3, 4, and 5 are not affected because the MadWifi driver is not shipped with those distributions. ↗
- ·The WPA IE length field in the exploit beacon is dynamically patched at runtime (FIX_BYTE macro); the exact length byte in captured frames will vary depending on pad_space and shellcode size, so length-based detection rules must use a threshold (> expected max) rather than an exact value. ↗
CVSS provenance
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vendor_redhat7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-35mj-3pg9-j9v7: Stack-based buffer overflow in net80211/ieee80211_wireless
ghsa_unreviewed·2022-05-01
CVE-2006-6332 [HIGH] GHSA-35mj-3pg9-j9v7: Stack-based buffer overflow in net80211/ieee80211_wireless
Stack-based buffer overflow in net80211/ieee80211_wireless.c in MadWifi before 0.9.2.1 allows remote attackers to execute arbitrary code via unspecified vectors, related to the encode_ie and giwscan_cb functions.
Ubuntu
MadWifi vulnerability
vendor_ubuntu·2007-01-09
CVE-2006-6332 MadWifi vulnerability
Title: MadWifi vulnerability
Summary: MadWifi vulnerability
Laurent Butti, Jerome Razniewski, and Julien Tinnes discovered that the
MadWifi wireless driver did not correctly check packet contents when
receiving scan replies. A remote attacker could send a specially
crafted packet and execute arbitrary code with root privileges.
Instructions: After a standard system upgrade you need to reboot your computer to
effect the necessary changes.
Red Hat
CVE-2006-6332: Stack-based buffer overflow in net80211/ieee80211_wireless
vendor_redhat·CVSS 7.5
CVE-2006-6332 [HIGH] CVE-2006-6332: Stack-based buffer overflow in net80211/ieee80211_wireless
Stack-based buffer overflow in net80211/ieee80211_wireless.c in MadWifi before 0.9.2.1 allows remote attackers to execute arbitrary code via unspecified vectors, related to the encode_ie and giwscan_cb functions.
Statement: Not vulnerable. The MadWiFi wireless driver is not shipped with Red Hat Enterprise Linux 2.1, 3, 4, or 5.
No detection rules found.
Exploit-DB
Madwifi - SIOCGIWSCAN Buffer Overflow (Metasploit)
exploitdb·2010-09-20
CVE-2006-6332 Madwifi - SIOCGIWSCAN Buffer Overflow (Metasploit)
Madwifi - SIOCGIWSCAN Buffer Overflow (Metasploit)
---
##
# $Id: madwifi_giwscan_cb.rb 10394 2010-09-20 08:06:27Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
# Madwifi remote kernel exploit
# 100% reliable, doesn't crash wifi stack, can exploit
# same target multiple times
#
# Julien TINNES
# Laurent BUTTI
#
# vuln in giwscan_cb, here's the path:
#
# ieee80211_ioctl_giwscan -> ieee80211_scan_iterate -> sta_iterate -> giwscan_cb
#
require 'msf/core'
require 'metasm'
class Metasploit3 'Madwifi SIOCGIWSCAN Buffer Overflow',
'Description' => %q{
The Madwifi driver unde
Exploit-DB
Madwifi 0.9.2.1 - WPA/RSN IE Remote Kernel Buffer Overflow
exploitdb·2007-03-01
CVE-2006-6332 Madwifi 0.9.2.1 - WPA/RSN IE Remote Kernel Buffer Overflow
Madwifi 0.9.2.1 - WPA/RSN IE Remote Kernel Buffer Overflow
---
/* ---- madwifi WPA/RSN IE remote kernel buffer overflow ------
* expoit code by: sgrakkyu antifork.org -- 10/1/2007
*
* CVE: 2006-6332 (Laurent BUTTI, Jerome RAZNIEWSKI, Julien TINNES)
*
* (for wpa)
* ....
* memcpy(buf, se->se_wpa_ie, se->se_wpa_ie[1] + 2)
* ....
* ....
* the function re-uses args in the stack before returning so we
* can't trash them overwriting.
* Different compiled module [ex. different version of gcc] may require
* a different pad value.. (see -g option)
*
* ex:
* on one terminal runs: nc -l -p 31337
* phi:~/kexec/lorcon# gcc -g -o madwifi_exp madwifi_exp.c -lorcon
* phi:~/kexec/lorcon# wlanconfig ath1 create wlandev wifi0 wlanmode monitor
* phi:~/kexec/lorcon# ifconfig ath1 up
* phi:~/kexec/lorcon# ./ma
Exploit-DB
Madwifi < 0.9.2.1 - SIOCGIWSCAN Buffer Overflow (Metasploit)
exploitdb·2006-12-08
CVE-2006-6332 Madwifi < 0.9.2.1 - SIOCGIWSCAN Buffer Overflow (Metasploit)
Madwifi
# Laurent BUTTI
#
# vuln in giwscan_cb, here's the path:
#
# ieee80211_ioctl_giwscan -> ieee80211_scan_iterate -> sta_iterate -> giwscan_cb
#
require 'msf/core'
require 'metasm'
class Metasploit3 'Madwifi SIOCGIWSCAN Buffer Overflow',
'Description' => %q{
The Madwifi driver under Linux is vulnerable to a remote kernel-mode
stack-based buffer overflow.
The vulnerability is triggered by one of these properly crafted .
information element: WPA, RSN, WME and Atheros OUI Current madwifi .
driver (0.9.2) and and all madwifi-ng drivers since r1504 are .
vulnerable .
Madwifi 0.9.2.1 release corrects the issue.
This module has been tested against Ubuntu 6.10 and is 100% reliable,
does'nt crash the Wifi stack and can exploit the same machine multiple
time without the need to reboot it.
No writeups or analysis indexed.
http://lists.immunitysec.com/pipermail/dailydave/2006-December/003888.htmlhttp://madwifi.org/changeset/1842http://madwifi.org/wiki/news/20061207/release-0-9-2-1-fixes-critical-security-issuehttp://secunia.com/advisories/23277http://secunia.com/advisories/23335http://secunia.com/advisories/23694http://security.gentoo.org/glsa/glsa-200612-09.xmlhttp://www.kb.cert.org/vuls/id/925529http://www.novell.com/linux/security/advisories/2006_28_sr.htmlhttp://www.novell.com/linux/security/advisories/2006_74_madwifi.htmlhttp://www.securityfocus.com/bid/21486http://www.ubuntu.com/usn/usn-404-1http://www.vupen.com/english/advisories/2006/4901https://exchange.xforce.ibmcloud.com/vulnerabilities/30800http://lists.immunitysec.com/pipermail/dailydave/2006-December/003888.htmlhttp://madwifi.org/changeset/1842http://madwifi.org/wiki/news/20061207/release-0-9-2-1-fixes-critical-security-issuehttp://secunia.com/advisories/23277http://secunia.com/advisories/23335http://secunia.com/advisories/23694http://security.gentoo.org/glsa/glsa-200612-09.xmlhttp://www.kb.cert.org/vuls/id/925529http://www.novell.com/linux/security/advisories/2006_28_sr.htmlhttp://www.novell.com/linux/security/advisories/2006_74_madwifi.htmlhttp://www.securityfocus.com/bid/21486http://www.ubuntu.com/usn/usn-404-1http://www.vupen.com/english/advisories/2006/4901https://exchange.xforce.ibmcloud.com/vulnerabilities/30800
2006-12-10
Published