Argus Systems

OpenBSD before commit 1ee99df contains an inverted comparison vulnerability in the ieee80211 michael mic failure() function within sys/net80211/ieee80211 crypto tkip.c that allows unauthenticated attackers within RF range to trigger denial of service by sending two malformed TKIP frames separated by more than 60 seconds. Attackers can exploit the reversed TKIP MIC failure countermeasure window check to deauthenticate all associated TKIP stations and block reassociation for up to 90 seconds, while within-window MIC failures that should engage countermeasures are silently discarded, leaving key-recovery attempts undetected.

**Name of the Vulnerable Software and Affected Versions** OpenBSD versions prior to commit 6a23123 **Description** An out-of-bounds read exists in the `mpls do error()` function within sys/netmpls/mpls input.c. Remote attackers can disclose kernel stack memory by sending crafted MPLS frames containing 16 labels without the Bottom-of-Stack bit set. This trigger causes the system to leak 4 bytes of adjacent kernel stack memory back to the attacker within an ICMP/MPLS error response. **Recommendations** Update to the version containing commit 6a23123 or later. As a temporary workaround, disable MPLS to minimize the risk of exploitation.