Please Install the Updated Packages.

The 802.11 network stack in MadWifi prior to 0.9.3.1 would alloa remote attackers to cause a denial of service (system hang) via a crafted length field in nested 802.3 Ethernet frames in Fast Frame packets, which results in a NULL pointer dereference (CVE-2007-2829). The ath_beacon_config function in MadWifi prior to 0.9.3.1 would allow a remote attacker to cause a denial of service (system crash) via crafted beacon interval information when scanning for access points, which triggered a divide-by-zero error (CVE-2007-2830). An array index error in MadWifi prior to 0.9.3.1 would allow a local user to cause a denial of service (system crash) and possibly obtain kerenl memory contents, as well as possibly allowing for the execution of arbitrary code via a large negative array index value (CVE-2007-2831). Updated packages have been updated to 0.9.3.1 to correct these issues. Wpa_supplicant is built using madwifi-source and has been rebuilt using 0.9.3.1 source.

madwifi-source on Mandriva Linux 2007.0, Mandriva Linux 2007.0/X86_64, Mandriva Linux 2007.1, Mandriva Linux 2007.1/X86_64