Tuomo Untinen

A single malformed IEEE 802.15.4 (Zigbee) frame can make the TRÅDFRI gateway unresponsive. This results in connected lighting being unable to be controlled with the IKEA Home Smart app and TRÅDFRI remote control. The issue is caused by an unauthenticated broadcast message, affecting all vulnerable devices within radio range.

The issue arises when an attacker sends a single malformed IEEE 802.15.4 (Zigbee) frame, causing the TRÅDFRI bulb to blink. If the same frame is replayed multiple times, the bulb performs a factory reset, resulting in the loss of configuration information about the Zigbee network and current brightness level. After this attack, all lights are on with full brightness, and a user cannot control the bulbs with either the IKEA Home Smart app or the TRÅDFRI remote control. The malformed Zigbee frame is an unauthenticated broadcast message, which means all vulnerable devices within radio range are affected.

An issue was discovered where a partially completed WPA handshake is sufficient for obtaining full access to the wireless network. A client can access the network by sending packets on Data Frames to the AP without encryption. The vulnerability is related to an incorrectly implemented authentication mechanism in the WPA algorithm of the D-Link DIR-850L firmware. Exploitation of the vulnerability may allow an attacker to bypass security restrictions by sending specially crafted packets.

The issue allows remote attackers to cause a denial of service due to a NULL pointer dereference via an invalid IPv6 jumbogram.

The issue is related to multiple vulnerabilities in the Quagga package, which can lead to disruption of confidentiality, integrity, and availability of protected information. Exploitation of these vulnerabilities can be done remotely. A heap-based buffer overflow in the `ecommunity ecom2str` function in `bgp ecommunity.c` in `bgpd` in Quagga before version 0.99.19 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code by sending a crafted BGP UPDATE message over IPv4.

The issue affects the Quagga package in various Linux operating systems, including Red Hat Enterprise Linux, CentOS, SUSE Linux Enterprise, and openSUSE. It allows remote attackers to cause a denial of service (daemon crash) via an invalid Link State Advertisement (LSA) type in an IPv4 Link State Update message. The `ospf flood` function in `ospf flood.c` in `ospfd` is vulnerable. This can lead to disruption of confidentiality, integrity, and availability of protected information.

The issue allows remote attackers to cause a denial of service via trailing zero values in the Link State Advertisement (LSA) header list of an IPv6 Database Description message. This is due to the `ospf6 lsa is changed` function in `ospf6 lsa.c` in the OSPFv3 implementation in `ospf6d`. The vulnerability can lead to disruption of confidentiality, integrity, and availability of protected information.

The issue affects the Quagga package, allowing remote attackers to cause a denial of service via a Link State Update message with an invalid IPv6 prefix length. This can lead to disruption of confidentiality, integrity, and availability of protected information. The exploitation can be carried out remotely.