Intel Centrino Vulns - driver updates...

FYI…

- http://isc.sans.org/diary.php?compare=1&storyid=1535
Last Updated: 2006-08-01 21:51:10 UTC
"Intel has released driver security updates for Centrino device drivers for Windows and for the PROSet management software: http://support.intel.com/support/wireless/…b/CS-023068.htm
There are three issues identified:
Intel® Centrino Wireless Driver Malformed Frame Remote Code Execution
http://support.intel.com/support/wireless/…b/CS-023065.htm
Intel® PROSet/Wireless Software Local Information Disclosure
http://support.intel.com/support/wireless/…b/CS-023066.htm
Intel® Centrino Wireless Driver Malformed Frame Privilege Escalation
http://support.intel.com/support/wireless/…b/CS-023067.htm
The first and the third seem to be most severe. At this point we don't know of any public exploits for these vulnerabilities. The second one (PROSet info disclosure) has been around for a while and is known but local only. The announcements contain details on which drivers are vulnerable as well as links to patches and a tool to determine which version you have- http://support.intel.com/support/wireless/…b/cs-005905.htm
Below are the summaries of the affected platforms
> Intel® Centrino Wireless Driver Malformed Frame Remote Code Execution
* Intel® PRO/Wireless 2200BG Network Connection
* Intel® PRO/Wireless 2915ABG Network Connection
> Intel® PROSet/Wireless Software Local Information Disclosure
* Intel® PRO/Wireless 2100 Network Connection
* Intel® PRO/Wireless 2200BG Network Connection
* Intel® PRO/Wireless 2915ABG Network Connection
* Intel® PRO/Wireless 3945ABG Network Connection
> Intel® Centrino Wireless Driver Malformed Frame Privilege Escalation
* Intel® PRO/Wireless 2100 Network Connection

The details of which drivers are listed on the pages and we recommend you look there. As far as we know, these will not be delivered via the Microsoft Update tool. You will need to download and install them manually unless your system vendor (the folk who make your laptop) provides an automated tool for you. Before you download and install these, we strongly suggest you talk to your system vendors and see if they are coming out with custom versions of the patches…"

FYI…

- http://www.informationweek.com/shared/prin…cleID=191601574
Aug. 2, 2006
"…In an e-mail to the SANS mailing list and government security researchers, SANS Institute Director Alan Paller warns, "This is a big story for several reasons. First it shoots a pretty big hole in the 'bulletproof' image Apple is trying to project (notice the words Maynor used in the Krebs interview*). Second, it isn't just about Macs. The vulnerabilities apparently can also be found in Centrino-based laptops as well. Third, by nature, attackers (a.k.a. security researchers) are swarm organisms. That means they will see Maynor's work as a beacon to follow toward a new cache of useful vulnerabilities. And finally, the really bad guys are already using these flaws (and are frustrated that Maynor is making them public)"… Intel has released driver security updates for Centrino device drivers** for Windows and for the Intel PROSet management software. Until a patch has been applied, consider unwiring your wireless. "[P]atching the Centrino flaws and turning off wireless cards is indicated as an immediate response," Paller recommends. Firewalls are unlikely to help because they're not designed to filter low-level wireless device communication…"

* http://blog.washingtonpost.com/securityfix…_60_seco_1.html

** http://support.intel.com/support/wireless/…b/CS-023068.htm

FYI… good stuff!

- http://blog.washingtonpost.com/securityfix…_to_fix_wi.html
August 3, 2006
"…The Intel Web site* with more information on these flaws includes a tool that people can use to tell whether they need to download and install software updates to fix the problems. I would strongly advise anyone using a laptop with an embedded wireless card to pay a visit to the page and run the tool, as many, many computer manufacturers embed Intel's hardware and software into their machines…"

* http://support.intel.com/support/wireless/…b/cs-005905.htm
Intel® PRO/Wireless Network Connection ID Tool

FYI…

Problems with Intel wireless drivers
- http://isc.sans.org/diary.php?storyid=1633
Last Updated: 2006-08-24 07:10:38 UTC
"…Intel initially issued a big file (100MB) that you had to download, but at least it upgraded everything on your machine, if it needed upgrades. After rebooting in the next few days I noticed that my machine is a bit slower then it was. A look at Task manager output, or excellent Process Explorer from Sysinternals showed that a process called S24EvMON.exe is using quite a bit of CPU… Dell… released their own version of drivers… Dell's drivers have the same problem… It looks that everyone with (at least) 2915ABG/2200BG wireless cards is affected. F-secure posted this in their weblog as well* …
UPDATE:
The easiest way to start and stop these services (so you actually run them only when you really need them) is to create a batch file that will do this job for you (so you don't have to click manually on all 4 of them). You can use the sc start and sc stop commands to perform this for you…
UPDATE 2:
..You can use the built-in Windows Wireless Zero Config service, in which case you only need to patch the driver for your wireless card, so you are not vulnerable. As the problem with CPU/memory leaks are in the management service, this is an effective workaround at least until the management service is fixed…"

Working with the Intel Wi-Fi Drivers Again
* http://www.f-secure.com/weblog/archives/ar…6.html#00000954
August 21, 2006
"…We noticed that software (S24EvMON.exe) installed with the driver seems to be leaky. It's eating tons of file handles and tons of memory - and it continues to grow!… Intel's tech support has replied. They are aware of the issue and are currently at work on it. No official release date yet. We'll let you know."

(Screenshots available at -both- URL's above.)

.

FYI…

- http://isc.sans.org/diary.php?storyid=1643
Last Updated: 2006-08-26 18:16:44 UTC
"Release Notes for the Intel® PRO/Wireless 3945ABG Network Connection update have been posted at Intel. The release notes* describe a number of bug fixes including Memory Utilization Increase issues… The download location for Intel® PROSet/Wireless Software version 10.5.0.1 is here**…"

* http://downloadmirror.intel.com/df-support…NG/relnotes.htm
> "…Issues resolved in this release
o Potential Memory Utilization Increase
o Profiles Not Migrated When Upgrading from Previous Software Version
o Potential Auto-Suspend Failure when using Microsoft Windows* 2000
o Intermittent Authentication Failure with Cisco Access Point in Heavy Traffic Environment
o Intermittent Failure to Load or Save a Roaming Profile…"

** http://support.intel.com/support/wireless/…b/CS-010623.htm