DGNum/hostapd
6
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions
hostapd/src/eap_server
History
Jouni Malinen 586c446e0f EAP-TLS server: Fix TLS Message Length validation 
EAP-TLS/PEAP/TTLS/FAST server implementation did not validate TLS
Message Length value properly and could end up trying to store more
information into the message buffer than the allocated size if the first
fragment is longer than the indicated size. This could result in hostapd
process terminating in wpabuf length validation. Fix this by rejecting
messages that have invalid TLS Message Length value.

This would affect cases that use the internal EAP authentication server
in hostapd either directly with IEEE 802.1X or when using hostapd as a
RADIUS authentication server and when receiving an incorrectly
constructed EAP-TLS message. Cases where hostapd uses an external
authentication are not affected.

Thanks to Timo Warns for finding and reporting this issue.

Signed-hostap: Jouni Malinen <j@w1.fi>
intended-for: hostap-1
2012-10-07 20:06:29 +03:00
..
eap.h Remove the GPL notification from files contributed by Jouni Malinen 2012-02-11 19:39:36 +02:00
eap_i.h EAP-SIM DB: Use pointer to struct eap_sim_db_data instead of void* 2012-09-01 21:48:48 +03:00
eap_methods.h Add UNAUTH-TLS vendor specific EAP type 2012-08-22 22:34:11 +03:00
eap_server.c Add extra validation of EAP header length field 2012-08-07 23:03:25 +03:00
eap_server_aka.c EAP-AKA server: Skip AKA/Identity exchange if EAP identity recognized 2012-09-02 11:27:39 +03:00
eap_server_fast.c Remove the GPL notification from files contributed by Jouni Malinen 2012-02-11 19:39:36 +02:00
eap_server_gpsk.c Remove the GPL notification from files contributed by Jouni Malinen 2012-02-11 19:39:36 +02:00
eap_server_gtc.c Remove the GPL notification from files contributed by Jouni Malinen 2012-02-11 19:39:36 +02:00
eap_server_identity.c Remove the GPL notification from files contributed by Jouni Malinen 2012-02-11 19:39:36 +02:00
eap_server_ikev2.c Remove the GPL notification from files contributed by Jouni Malinen 2012-02-11 19:39:36 +02:00
eap_server_md5.c EAP-MD5: Verify that CHAP operation succeeds 2012-08-16 18:49:02 +03:00
eap_server_methods.c Remove the GPL notification from files contributed by Jouni Malinen 2012-02-11 19:39:36 +02:00
eap_server_mschapv2.c Remove the GPL notification from files contributed by Jouni Malinen 2012-02-11 19:39:36 +02:00
eap_server_pax.c Remove the GPL notification from files contributed by Jouni Malinen 2012-02-11 19:39:36 +02:00
eap_server_peap.c Remove the GPL notification from files contributed by Jouni Malinen 2012-02-11 19:39:36 +02:00
eap_server_psk.c Remove the GPL notification from files contributed by Jouni Malinen 2012-02-11 19:39:36 +02:00
eap_server_pwd.c EAP-pwd: Replace direct OpenSSL HMAC use with wrapper 2012-07-02 22:10:03 +03:00
eap_server_sake.c Remove the GPL notification from files contributed by Jouni Malinen 2012-02-11 19:39:36 +02:00
eap_server_sim.c EAP-SIM server: Move subtype validation from check into process 2012-09-02 01:42:05 +03:00
eap_server_tls.c Add UNAUTH-TLS vendor specific EAP type 2012-08-22 22:34:11 +03:00
eap_server_tls_common.c EAP-TLS server: Fix TLS Message Length validation 2012-10-07 20:06:29 +03:00
eap_server_tnc.c Remove unnecessary base64.h inclusion 2012-08-19 18:41:45 +03:00
eap_server_ttls.c Fix memory allocation failure handling in EAP-TTLS/MSCHAPv2 server 2012-08-19 17:23:00 +03:00
eap_server_vendor_test.c Use proper private enterprise number for EAP VENDOR-TEST 2012-08-22 21:37:19 +03:00
eap_server_wsc.c Remove the GPL notification from files contributed by Jouni Malinen 2012-02-11 19:39:36 +02:00
eap_sim_db.c EAP-SIM DB: Remove unnecessary username prefix checks 2012-09-02 12:03:57 +03:00
eap_sim_db.h EAP-SIM DB: Use pointer to struct eap_sim_db_data instead of void* 2012-09-01 21:48:48 +03:00
eap_tls_common.h Add UNAUTH-TLS vendor specific EAP type 2012-08-22 22:34:11 +03:00
ikev2.c Remove the GPL notification from files contributed by Jouni Malinen 2012-02-11 19:39:36 +02:00
ikev2.h Remove the GPL notification from files contributed by Jouni Malinen 2012-02-11 19:39:36 +02:00
Makefile Remove unnecessary SUBDIRS loops from src/*/Makefile 2010-04-17 17:10:31 +03:00
tncs.c Remove the GPL notification from files contributed by Jouni Malinen 2012-02-11 19:39:36 +02:00
tncs.h Remove the GPL notification from files contributed by Jouni Malinen 2012-02-11 19:39:36 +02:00