Description
An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3 implementations accept plaintext A-MSDU frames as long as the first 8 bytes correspond to a valid RFC1042 (i.e., LLC/SNAP) header for EAPOL. An adversary can abuse this to inject arbitrary network packets independent of the network configuration.
CVSS breakdown
CVSS 3.1
Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None
Affected products
- Arista / c-100_firmware11.0.0-36
- Arista / c-110_firmware11.0.0-36
- Arista / c-120_firmware11.0.0-36
- Arista / c-130_firmware11.0.0-36
- Arista / c-200_firmware11.0.0-36
- Arista / c-230_firmware10.0.1-31
- Arista / c-235_firmware10.0.1-31
- Arista / c-250_firmware10.0.1-31
- Arista / c-260_firmware10.0.1-31
- Arista / c-65_firmware
- Arista / c-75_firmware
- Arista / o-105_firmware11.0.0-36
- Arista / o-90_firmware
- Arista / w-118_firmware11.0.0-36
- Arista / w-68_firmware
- Samsung / galaxy_i9305_firmware4.4.4 – 4.4.4
- Siemens / scalance_w700_ieee_802.11ax_firmware
- Siemens / scalance_w700_ieee_802.11n_firmware
References
- VENDOR_ADVISORYhttps://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wifi-faf-22epcEWu
- MISChttps://www.fragattacks.com
- MISChttps://github.com/vanhoefm/fragattacks/blob/master/SUMMARY.md
- MAILING_LISThttp://www.openwall.com/lists/oss-security/2021/05/11/12
- MISChttps://cert-portal.siemens.com/productcert/pdf/ssa-913875.pdf
- VENDOR_ADVISORYhttps://www.arista.com/en/support/advisories-notices/security-advisories/12602-security-advisory-63
Updated 40m ago · 8 sources