{"vuid":"VU#524332","idnumber":"524332","name":"Intel Centrino wireless drivers fail to properly process malformed frames","keywords":["Intel","Centrino","ipw2200","Integrated Wireless Card","remote code execution","0day"],"overview":"Microsoft Windows drivers for Intel Centrino wireless adapters fail to properly handle malformed frames. This vulnerability may allow an attacker to execute arbitrary code.","clean_desc":"The Microsoft Windows drivers for Intel Centrino 2200BG and 2915ABG PRO wireless adapters fail to properly handle malformed frames. If an attacker within 802.11 radio range of an affected wireless adapter sends a specially crafted frame to that adapter, they may be able to trigger this vulnerability. Affected drivers include w22n50.sys, w22n51.sys, w29n50.sys, and w29n51.sys. For more information refer to Intel Security Advisory INTEL-SA-00001.","impact":"An unauthenticated, remote attacker may be able to execute arbitrary code with kernel-level privileges.","resolution":"Upgrade Intel drivers\nIntel has released updates to address this issue. The Intel support site also provides a tool to assist users in determining the model and version of the wireless adapter they are using.","workarounds":"Disable the affected wireless adapter Until updates can be applied, turning off the affected wireless adapter may mitigate this vulnerability.","sysaffected":"","thanks":"This issue was made public by Giuseppe Gottardi.","author":"This document was written by Ryan Giobbi.","public":["http://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00001&languageid=en-fr","http://support.intel.com/support/wireless/wlan/sb/cs-005905.htm","http://www.intel.com/network/connectivity/products/wireless/prowireless_mobile.htm","http://www.milw0rm.org/exploits/3158"],"cveids":[""],"certadvisory":"","uscerttechnicalalert":null,"datecreated":"2007-01-22T15:53:48Z","publicdate":"2007-01-22T00:00:00Z","datefirstpublished":"2007-04-05T14:39:03Z","dateupdated":"2007-04-09T12:49:52Z","revision":11,"vrda_d1_directreport":"1","vrda_d1_population":"2","vrda_d1_impact":"3","cam_widelyknown":"18","cam_exploitation":"0","cam_internetinfrastructure":"4","cam_population":"8","cam_impact":"15","cam_easeofexploitation":"9","cam_attackeraccessrequired":"10","cam_scorecurrent":"4.455","cam_scorecurrentwidelyknown":"4.86","cam_scorecurrentwidelyknownexploited":"8.91","ipprotocol":"","cvss_accessvector":"--","cvss_accesscomplexity":"--","cvss_authentication":null,"cvss_confidentialityimpact":"--","cvss_integrityimpact":"--","cvss_availabilityimpact":"--","cvss_exploitablity":null,"cvss_remediationlevel":"ND","cvss_reportconfidence":"ND","cvss_collateraldamagepotential":"ND","cvss_targetdistribution":"ND","cvss_securityrequirementscr":"ND","cvss_securityrequirementsir":"ND","cvss_securityrequirementsar":"ND","cvss_basescore":"0","cvss_basevector":"AV:--/AC:--/Au:--/C:--/I:--/A:--","cvss_temporalscore":"0","cvss_environmentalscore":"0","cvss_environmentalvector":"CDP:ND/TD:ND/CR:ND/IR:ND/AR:ND","metric":4.455,"vulnote":null}