diff options
| author | Jouni Malinen <jouni@qca.qualcomm.com> | 2016-03-04 18:46:41 +0200 |
|---|---|---|
| committer | Sravanthi Palakonda <srapal@codeaurora.org> | 2016-05-30 14:56:54 +0530 |
| commit | 008fb49d123ef039b0f594b9476367d48920f93a (patch) | |
| tree | 64ea1bb53dee9e3d9fa365897b29fd74923c969f | |
| parent | ed2afd0f75d978720785ae63bba74085f7d820ed (diff) | |
| download | android_external_wpa_supplicant_8-008fb49d123ef039b0f594b9476367d48920f93a.tar.gz android_external_wpa_supplicant_8-008fb49d123ef039b0f594b9476367d48920f93a.tar.bz2 android_external_wpa_supplicant_8-008fb49d123ef039b0f594b9476367d48920f93a.zip | |
Reject psk parameter set with invalid passphrase character
WPA/WPA2-Personal passphrase is not allowed to include control
characters. Reject a passphrase configuration attempt if that passphrase
includes an invalid passphrase.
This fixes an issue where wpa_supplicant could have updated the
configuration file psk parameter with arbitrary data from the control
interface or D-Bus interface. While those interfaces are supposed to be
accessible only for trusted users/applications, it may be possible that
an untrusted user has access to a management software component that
does not validate the passphrase value before passing it to
wpa_supplicant.
This could allow such an untrusted user to inject up to 63 characters of
almost arbitrary data into the configuration file. Such configuration
file could result in wpa_supplicant trying to load a library (e.g.,
opensc_engine_path, pkcs11_engine_path, pkcs11_module_path,
load_dynamic_eap) from user controlled location when starting again.
This would allow code from that library to be executed under the
wpa_supplicant process privileges.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Git-commit: 73e4abb24a936014727924d8b0b2965edfc117dd
Git-repo: git://w1.fi/srv/git/hostap.git
Change-Id: Ifa826eb7de2cba5458e8bb31dca3259cb37b4005
CRs-fixed: 1007548
| -rw-r--r-- | wpa_supplicant/config.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/wpa_supplicant/config.c b/wpa_supplicant/config.c index b736394a..2bbb54c0 100644 --- a/wpa_supplicant/config.c +++ b/wpa_supplicant/config.c @@ -456,6 +456,12 @@ static int wpa_config_parse_psk(const struct parse_data *data, } wpa_hexdump_ascii_key(MSG_MSGDUMP, "PSK (ASCII passphrase)", (u8 *) value, len); + if (has_ctrl_char((u8 *) value, len)) { + wpa_printf(MSG_ERROR, + "Line %d: Invalid passphrase character", + line); + return -1; + } if (ssid->passphrase && os_strlen(ssid->passphrase) == len && os_memcmp(ssid->passphrase, value, len) == 0) return 0; |