Intel Offers Security Fixes for Centrino

Intel has updated the software behind its Centrino chip bundle to fix three security vulnerabilities that, in one case, could allow an attacker to execute code remotely on a laptop.

The chip maker on July 28 posted a trio of updates for its Intel/PRO Wireless Network Connection wireless modules.

The Wi-Fi modules, which allow notebooks to connect to 802.11 wireless networks, are part of the chip makers Centrino chip bundle, which it has offered for notebook PCs since 2003.

The updates generally fix problems with the way Windows drivers and other software associated with controlling them use memory.

Thus far, Intel is not aware of any malicious uses of the vulnerabilities by would be attackers, a company spokesperson said.

However, security of things like 802.11 wireless have been top of mind this week thanks to the Black Hat hacker conference, which is taking place in Las Vegas on Aug. 2 and 3.

The most severe of the three security vulnerabilities, which affects Windows drivers for the Intel 2200BG PRO/Wireless and 2915ABG PRO/Wireless modules, could allow an attacker thats within range of a Wi-Fi station to executive code remotely and ultimately gain control of a system, Intels support Web site said.

A second Windows driver vulnerability for the Intel PRO 2100, an earlier 802.11b-only module, could be exploited to gain system kernel-level access though the process of injecting specially crafted frames into the driver in concert with using an application loaded on the system, the site said.

/zimages/4/28571.gifClick hereto read more about Intels Centrino.

The third update changes the way that the Intel PROSet/Wireless Software, which works to control all of Intels Intel Pro/Wireless Wi-Fi modules, shares memory.

Due to insecure usage of shared memory by the application, it left access to a users wireless network security information open to an attacker, Intels Web site says.

Intel, which generally updates its Centrino software about four times per quarter, posted the patches on July 28.

The chip maker has also provided the upgraded software to PC makers for testing and for them to provide it directly to their customers, the Intel spokesperson said.

Intel supplies regular maintenance updates—and not just security patches—with its quarterly Centrino software releases, the spokesperson said.

The three updates, in addition to tools to help users determine the type of module they have, are available from Intels support site.

Although Intel suggests on the site that notebook owners check first with their machines manufacturers to determine whether those companies are offering the upgrades as well, given that some manufacturers might have replaced parts of the software or customized it in some way to work with their systems.

/zimages/4/28571.gifCheck out eWEEK.coms for the latest news in desktop and notebook computing.