MOKB-22-11-2006: NetGear WG311v1 Wireless Driver Long SSID Overflow

The NetGear WG311v1 wireless adapter (PCI) ships with a version of WG311ND5.SYS that is vulnerable to a heap-based buffer overflow condition. This issue may lead to arbitrary kernel-mode code execution.

• More details and debugging information
• Proof of concept: auxiliary/dos/wireless/netgear_wg311pci.rb

MOKB-18-11-2006: NetGear MA521 Wireless Driver Long Rates Overflow

The NetGear MA521 wireless adapter (PCMCIA) ships with a version of MA521nd5.SYS that is vulnerable to a memory corruption condition. This issue may lead to arbitrary kernel-mode code execution.

• More details and debugging information
• Proof of concept: netgear_ma521_rates.rb

MOKB-16-11-2006: NetGear WG111v2 Wireless Driver Long Beacon Overflow

The NetGear WG111v2 wireless adapter (USB) ships with a version of WG111v2.SYS that is vulnerable to a stack-based buffer overflow. This overflow can lead to arbitrary kernel-mode code execution. The overflow occurs when a 802.11 beacon request is received that contains over 1100 bytes of information elements.

• More details
• Proof of concept: netgear_wg111_beacon.rb

MOKB-13-11-2006: D-Link DWL-G132 Wireless Driver Beacon Rates Overflow

The D-Link DWL-G132 wireless adapter (USB) ships with a version of A5AGU.SYS that is vulnerable to a stack-based buffer overflow. This overflow can lead to arbitrary kernel-mode code execution. The overflow occurs when a 802.11 beacon request is received that contains over 36 bytes in the Rates information element (IE).

• More details
• Proof of concept: dlink_wifi_rates.rb (Metasploit)

MOKB-11-11-2006: Broadcom Wireless Driver Probe Response SSID Overflow

The Broadcom BCMWL5.SYS wireless device driver is vulnerable to a stack-based buffer overflow that can lead to arbitrary kernel-mode code execution. This particular vulnerability is caused by improper handling of 802.11 probe responses containing a long SSID field. The BCMWL5.SYS driver is bundled with new PCs from HP, Dell, Gateway, eMachines, and other computer manufacturers.

• More details
• Proof of concept: broadcom_wifi_ssid.rb (Metasploit)

MOKB-06-11-2006: Microsoft Windows kernel GDI local privilege escalation

A vulnerability in the handling of GDI kernel structures of Microsoft Windows leads to an exploitable memory corruption condition, causing a denial of service (so-called BSoD) or arbitrary code execution on successful exploitation. This would allow a local user to escalate privileges, gaining full control of the system.

• More details and debug information
• Proof of concept: GDIKernelPoC.cpp