Re: format string vuln in the wifi "applet"

2007-05-04 Thread pancake
> For the record, ESSIDs are not strings! For example, \0\0 is a valid (2- > byte) ESSID. i know, but my 'snippets' are just snippets, a string conversion should be required. If this piece of code is closed source this will explain why I didn't find the affected code :) --pancake _

Re: format string vuln in the wifi "applet"

2007-05-04 Thread Kalle Valo
"ext Volker Braun" <[EMAIL PROTECTED]> writes: > On a slightly related note, can anyone point me in the right direction > for the implementation of the EAP-TTLS MSchap authentification? That's closed source. Sorry. But what you could do is to port the WLAN driver cx3110x to use the latest wirel

Re: format string vuln in the wifi "applet"

2007-05-03 Thread Volker Braun
For the record, ESSIDs are not strings! For example, \0\0 is a valid (2- byte) ESSID. On a slightly related note, can anyone point me in the right direction for the implementation of the EAP-TTLS MSchap authentification? I was thinking about extending that to WEP+EAP TTLS PAP (university wireles

format string vuln in the wifi "applet"

2007-05-02 Thread pancake
One year ago I found a security hole in the wifi applet. Which interprets incorrectly the ESSID of the associated accesspoint. This is sprintf(buf, access_point_name); and should be snprintf(buf, BUFSIZE, "%s", access_point_name); Well these lines are in my mind (not in the maemo code), but