Security researchers have discovered a kernel-mode code execution vulnerability in a driver that ships with the popular D-Link DWL-G132 Wi-Fi adapter.
The $65 USB adapter ships with a version of a vulnerable driver (A5AGU.SYS) that could be exploited by hackers to cause a stack-based buffer overflow, according to an advisory posted as part of the MoKB (Month of Kernel Bugs) project.
The D-Link flaw warning follows similar discoveries in Wi-Fi drivers from Apple Computer and Broadcom.
Sources tell eWEEK that the MoKB project will expose several new bugs in USB wireless adapters throughout Nov. 2006.
/zimages/6/28571.gifRead morehereabout the demo of the Wi-Fi hack at the Black Hat conference.
The D-Link bug was discovered by HD Moore with assistance from Jon “Johnny Cache” Ellch, a Wi-Fi security expert who raised awareness about wireless driver bugs at this years Black Hat Briefings and then became entangled in a disclosure dispute with Apple and SecureWorks.
Ellch was also credited with finding the Broadcom driver flaw, but a spokesperson for Broadcom, in Irvine, Calif., said the issue was flagged during an internal audit that was prompted by Ellchs Black Hat presentation.
According to the MoKB warning, D-Link has resolved the issue in a new version of the A5AGU.SYS driver that ships with the D-Link WUA-2340 adapter. However, there is no patch available for the DWL-G132 adapter.
/zimages/6/28571.gifFor advice on how to secure your network and applications, as well as the latest security news, visit Ziff Davis InternetsSecurity IT Hub.
The buffer overflow occurs when a 802.11 Wi-Fi beacon request is received that contains over 36 bytes in the Rates information element. Since this vulnerability is exploited via beacon frames, all cards within range of the attacker will be affected.
A proof-of-concept exploit has been added to the Metasploit hacking tool.
/zimages/6/28571.gifCheck out eWEEK.coms for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at Ryan Naraines eWEEK SecurityWatch blog.