The Broadcom BCMWL5.SYS wireless device driver is vulnerable to a stack-based buffer overflow that can lead to arbitrary kernel-mode code execution. This particular vulnerability is caused by improper handling of 802.11 probe responses containing a long SSID field. The BCMWL5.SYS driver is bundled with new PCs from HP, Dell, Gateway, eMachines, and other computer manufacturers. Broadcom has released a fixed driver to their partners, which are in turn providing updates for the affected products. Linksys, Zonenet, and other wireless card manufactures also provide devices that ship with this driver.Internet Storm Center cũng có một bài phân tích sơ bộ về lổ hổng này:
All tests were performed with version 188.8.131.52 of the BCMWL5.SYS driver. Although this driver is for the Windows operating system, Linux and FreeBSD users of the ndiswrapper tool should determine if they are using BCMWL5.SYS and upgrade accordingly.
- Only effects the wireless driver, not the broadcom wired cards.
- The resepective file is BCMWL5.SYS Version 184.108.40.206 (this is the version pointed out as vulnerable. Others may be vulnerable as well).
- Only Linksys published an official update at this time.
- Other vendors have later versions of this file available as patches. It is not clear if they patch the problem or not.
- The problem is triggered by an overly long SSID
- the MOKB project published a metasploit module to ease exploitation of this problem.
Go ahead and patch your driver with whatever version they offer. If you get a chance, test the exploit and see if it works against some of the later versions. Of course, take care when doing so. The "known to be fixed" version from Linksys is 220.127.116.11.Một module khai thác lổ hổng này cũng đã được đưa vào Metasploit. Eo ôi, sợ quá! Cái máy Dell e1505 của tôi cũng sử dụng wireless card của Broadcom, đi upgrade thôi!
Whenever you don't use your wireless network, turn off the wireless card. In particular if you are in a public space (airport, hotel).
Cập nhật lúc 1:55PM GMT+7: ZERT vừa đưa ra FAQ về lổ hổng này. Đây là một lổ hổng cực kì nghiêm trọng, đề nghị những ai sử dụng laptop nên kiểm tra và nhanh chóng upgrade nếu như sử dụng card wireless của Broadcom.