Clemens Kolbitsch and Sylvester Keil have reported a vulnerability in MadWifi, which can be exploited by malicious people to cause a DoS (Denial of Service).

The vulnerability is caused due to an error in the processing of beacon frames. This can be exploited via a specially crafted beacon frame with an overly large "length" value (greater than 15) in the extended supported rates element ("xrates").

Successful exploitation causes the driver to exit and results in a kernel panic.

The vulnerability is reported in version 0.9.3.2. Other versions may also be affected.

Solution
Update to version 0.9.3.3.

Provided and/or discovered by
Clemens Kolbitsch and Sylvester Keil, Secure Systems Lab / SEC Consult

Changelog
Further details available to Secunia VIM customers

Original Advisory
MadWifi:
http://sourceforge.net/project/shownotes.php?release_id=547876

SEC Consult:
http://www.sec-consult.com/fileadmin/Advisories/20071012-0-madwifi-xrates.txt

Deep Links
Links available to Secunia VIM customers