Arch Linux alert ASA-202012-16 (hostapd)
| From: | Morten Linderud <foxboron@archlinux.org> | |
| To: | arch-security@archlinux.org | |
| Subject: | [ASA-202012-16] hostapd: proxy injection | |
| Date: | Thu, 17 Dec 2020 20:23:22 +0100 | |
| Message-ID: | <20201217192322.myu4nytj676tfg7j@anathema> |
Arch Linux Security Advisory ASA-202012-16 ========================================== Severity: Medium Date : 2020-12-09 CVE-ID : CVE-2020-12695 Package : hostapd Type : proxy injection Remote : Yes Link : https://security.archlinux.org/AVG-1322 Summary ======= The package hostapd before version 2.9-4 is vulnerable to proxy injection. Resolution ========== Upgrade to 2.9-4. # pacman -Syu "hostapd>=2.9-4" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL, aka the CallStranger issue. This issue could allow a device connected to the local network (i.e., a device that has been authorized to transmit packets in the network in which the AP is located) to trigger the AP to initiate a HTTP (TCP/IP) connection to an arbitrary URL, including connections to servers in external networks. Impact ====== An attacker on the local network might be able to force the AP to initiate a HTTP (TCP/IP) connection to an arbitrary URL, including connections to servers in external networks. References ========== https://bugs.archlinux.org/task/68861 https://w1.fi/security/2020-1/upnp-subscribe-misbehavior-... http://www.callstranger.com/ https://w1.fi/security/2020-1/0001-WPS-UPnP-Do-not-allow-... https://w1.fi/security/2020-1/0002-WPS-UPnP-Fix-event-mes... https://w1.fi/security/2020-1/0003-WPS-UPnP-Handle-HTTP-i... https://security.archlinux.org/CVE-2020-12695