[UNIX] Wireless Intrusion Detection Remote Root Compromise
From: SecuriTeam (support_at_securiteam.com)
To: firstname.lastname@example.org Date: 24 Aug 2003 17:12:22 +0200
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
- - - - - - - - -
Wireless Intrusion Detection Remote Root Compromise
<http://www.loud-fat-bloke.co.uk/w80211.html> WIDZ "the first Open Source
wireless IDS that has the ability to detects rogue Access Points,
Monkey-jacks, NULL probes, Floods, MAC Backlist nodes, and ESSID
blacklisted nodes, allowing you to catch bad guys in action". Due to
inappropriate filtering of code, it is possible to cause the program to
execute arbitrary commands.
* WIDZ version 1.5 and prior
if ( DEBUG )
printf("Alert unknown AP %s\n", target);
sprintf(mess,"Alert 'unknown AP %s\n'", target);
// Should do a check to see if we've alerted already but !!!
As you can see the function system(mess) is executed without proper
filtering, therefore it is possible to cause it to execute arbitrary code.
Go to apple airport and set network name to ';/usr/bin/id; (Use HostAP
snifz0r widz # ./widz_apmon 1 eth1 monitor
unknown AP essid=
sh: -c: line 3: unexpected EOF while looking for matching `''
sh: -c: line 4: syntax error: unexpected end of file
At this point, the attacker can pretty much do what they wish. As a side
note this is not the only WIDZ program to make use of system() in this
The information has been provided by <mailto:email@example.com> KF.
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: firstname.lastname@example.org
In order to subscribe to the mailing list, simply forward this email to: email@example.com
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.