CVEvulnerability
CVE-2015-5310
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2016-01-06
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 4.3 MEDIUM — CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- CVSS 2.0 ([email protected])
- 3.3 LOW — AV:A/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-200
Description
The WNM Sleep Mode code in wpa_supplicant 2.x before 2.6 does not properly ignore key data in response frames when management frame protection (MFP) was not negotiated, which allows remote attackers to inject arbitrary broadcast or multicast packets or cause a denial of service (ignored packets) via a WNM Sleep Mode response.
Affected configurations
• google android 4.4.4
• google android 5.0
• google android 5.1.1
• google android 6.0
• google android 6.0.1
Related
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- http://source.android.com/security/bulletin/2016-01-01.html Vendor Advisory
- http://w1.fi/security/2015-6/wpa_supplicant-unauthorized-wnm-sleep-mode-gtk-control.txt w1.fi
- http://www.debian.org/security/2015/dsa-3397 www.debian.org
- http://www.openwall.com/lists/oss-security/2015/11/10/9 www.openwall.com
- http://www.securityfocus.com/bid/77541 www.securityfocus.com
- http://www.securitytracker.com/id/1034592 www.securitytracker.com
- http://www.ubuntu.com/usn/USN-2808-1 www.ubuntu.com
- http://source.android.com/security/bulletin/2016-01-01.html Vendor Advisory
- http://w1.fi/security/2015-6/wpa_supplicant-unauthorized-wnm-sleep-mode-gtk-control.txt w1.fi
- http://www.debian.org/security/2015/dsa-3397 www.debian.org
- http://www.openwall.com/lists/oss-security/2015/11/10/9 www.openwall.com
- http://www.securityfocus.com/bid/77541 www.securityfocus.com
- http://www.securitytracker.com/id/1034592 www.securitytracker.com
- http://www.ubuntu.com/usn/USN-2808-1 www.ubuntu.com