QwikSec

Security Database

CVE

CWE

Training

CVE-2016-4477

Published: May 9, 2016

Modified: Aug 6, 2024

PUBLISHED

Description

wpa_supplicant 0.4.0 through 2.5 does not reject \n and \r characters in passphrase parameters, which allows local users to trigger arbitrary library loading and consequently gain privileges, or cause a denial of service (daemon outage), via a crafted (1) SET, (2) SET_CRED, or (3) SET_NETWORK command.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

http://source.android.com/security/bulletin/2016-05-01.html

x_refsource_CONFIRM

[oss-security] 20160503 Re: hostapd/wpa_supplicant - psk configuration parameter update allowing arbitrary data to be written

mailing-list

x_refsource_MLIST

vendor-advisory

x_refsource_UBUNTU

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.