Atheros Communications AR5416-AC1E Information Element Denial of Service Vulnerability

Bugtraq ID:	31012
Class:	Boundary Condition Error
CVE:	CVE-2007-5474
Remote:	Yes
Local:	No
Published:	Sep 04 2008 12:00AM
Updated:	Sep 04 2008 07:14PM
Credit:	Laurent Butti and Julien Tinnes from France Telecom / Orange
Vulnerable:	Linksys WRT350N 2.0.17 Atheros Communications AR5416-AC1E 0
Not Vulnerable:

Atheros Communications AR5416-AC1E Information Element Denial of Service Vulnerability

Atheros Communications AR5416-AC1E is prone to a denial-of-service vulnerability because it fails to perform adequate boundary checks on user-supplied data.

Attackers can exploit this issue to crash the affected device that uses the chipset, denying service to legitimate users. Given the nature of this issue, attackers may also be able to run arbitrary code, but this has not been confirmed.

Atheros AR5416-AC1E included in Linksys WRT35ON wireless router running firmware 2.00.17 is vulnerable; other devices running different firmware may also be affected.

Atheros Communications AR5416-AC1E Information Element Denial of Service Vulnerability

Attackers can exploit this issue by using readily available network utilities.

Atheros Communications AR5416-AC1E Information Element Denial of Service Vulnerability

Solution:
The reporter indicates that the vendor has fixed this issue, but Symantec has not confirmed this. Please see the references and contact the vendor for more information.

Atheros Communications AR5416-AC1E Information Element Denial of Service Vulnerability

References:

• Atheros Communication Homepage (Atheros)
  
• Linksys Homepage (Linksys)
  
• Atheros Vendor Specific Information Element Overflow (Laurent Butti )