There is a remotely triggerable panic in the wireless subsystem
involving WPA (a.k.a RSN).
RSN element parsing in the input path lacks validation of the group
cipher and group management cipher values. If a bad value is received
it is stored without validation, which will trigger a panic when the
value is used while sending a reply.
This can be used by malicious access points to crash OpenBSD clients,
or by malicious clients to crash OpenBSD access points.
Thanks to Franz Bettag for highlighting this problem.
Links to patches below. Please follow the instructions within.
5.8:
http://ftp.openbsd.org/pub/OpenBSD/patches/5.8/common/008_rsn.patch.sig 5.7:
http://ftp.openbsd.org/pub/OpenBSD/patches/5.7/common/020_rsn.patch.sig
--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)