CVE-2014-3686

Published: Oct 16, 2014Modified: May 6, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

wpa_supplicant and hostapd 0.7.2 through 2.2, when running with certain configurations and using wpa_cli or hostapd_cli with action scripts, allows remote attackers to execute arbitrary commands via a crafted frame.

Affected (16)

Products: Canonical: Ubuntu Linux · Debian: Debian Linux · W1.fi: Hostapd, Wpa Supplicant

1 product

1 product

2 products

Configuration A

16 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 10.04
Canonical Ubuntu Linux	Version 12.04
Canonical Ubuntu Linux	Version 14.04
Debian Debian Linux	Version 6.0
W1.fi Hostapd	Version 0.7.2
W1.fi Hostapd	Version 1.0
W1.fi Hostapd	Version 1.1
W1.fi Hostapd	Version 2.0
W1.fi Hostapd	Version 2.1
W1.fi Hostapd	Version 2.2
W1.fi Wpa Supplicant	Version 0.72
W1.fi Wpa Supplicant	Version 1.0
W1.fi Wpa Supplicant	Version 1.1
W1.fi Wpa Supplicant	Version 2.0
W1.fi Wpa Supplicant	Version 2.1
W1.fi Wpa Supplicant	Version 2.2

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (32)

http://advisories.mageia.org/MGASA-2014-0429.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2014-11/msg00000.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-updates/2014-10/msg00027.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-updates/2014-10/msg00028.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2014-1956.html

Source: secalert@redhat.com

http://secunia.com/advisories/60366

Source: secalert@redhat.com

http://secunia.com/advisories/60428

Source: secalert@redhat.com

http://secunia.com/advisories/61271

Source: secalert@redhat.com

http://w1.fi/security/2014-1/

Source: secalert@redhat.com

http://www.debian.org/security/2014/dsa-3052

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2015:120

Source: secalert@redhat.com

http://www.openwall.com/lists/oss-security/2014/10/09/28

Source: secalert@redhat.com

http://www.securityfocus.com/bid/70396

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-2383-1

Source: secalert@redhat.com

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1151259

Source: secalert@redhat.com

https://security.gentoo.org/glsa/201606-17

Source: secalert@redhat.com

http://advisories.mageia.org/MGASA-2014-0429.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2014-11/msg00000.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-updates/2014-10/msg00027.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-updates/2014-10/msg00028.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2014-1956.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/60366

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/60428

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/61271

Source: af854a3a-2127-422b-91ae-364da2661108

http://w1.fi/security/2014-1/

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.debian.org/security/2014/dsa-3052

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.mandriva.com/security/advisories?name=MDVSA-2015:120

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2014/10/09/28

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/70396

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ubuntu.com/usn/USN-2383-1

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1151259

Source: af854a3a-2127-422b-91ae-364da2661108

https://security.gentoo.org/glsa/201606-17

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.