Serious Intel PROset/Wireless Software vulnerabilities

Message

Puppy · #1 Post by **Puppy** » Sat Aug 05, 2006 7:58 am

Check this one: Highly critical http://secunia.com/advisories/20001/

Are there latest Intel drivers provided by IBM/Lenovo ? Software installer does not seem to offer any update yet.

Wiz · #2 Post by **Wiz** » Sat Aug 05, 2006 3:07 pm

A new driver that fix this security issue is not available from IBM/Lenovo yet, but you can download the updated driver from Intel. I currently use the latest driver from Intel and all features seems to work just fine. I did not however install the proset client from Intel. Just updated the driver.

unitedunited · #3 Post by **unitedunited** » Sun Aug 06, 2006 9:16 pm

if/when there is an update, it might not be available on software installer... you'll probably have to switch to System Update. I'm just checking the driver download page at lenovo and hoping they come out with an update soon, because this sounds pretty scary.

#4 Post by **bill bolton** » Sun Aug 06, 2006 11:31 pm

unitedunited wrote:because this sounds pretty scary.

It's made to sound that way, but in practice it's not something which will have any impact on wireless users who has a taken the standard steps, as recommended in many places on the web, to adequately secure their wireless connections.

It is something which should be fixed for the sake of completeness as it will impact some users.

Is it indeed highly critical for most domestic wireless users, definitely not!

Cheers,

Bill

QuadWorker · #5 Post by **QuadWorker** » Tue Aug 08, 2006 11:18 am

It is possible that v10.5 will be released the 3rd week of August by Lenovo. However, Intel may be updating the drivers again which would delay Lenovo making them available.

NovaxX · #6 Post by **NovaxX** » Wed Aug 09, 2006 9:37 am

I have updated the latest intel Wireless LAN Drivers that addresses the security issues without problems.

I did it using the Device Manager, Updata Driver method.

I am using Access Connections 4.12 and have no problems in the past week of using it.

The link for the driver is below.
http://downloadfinder.intel.com/scripts ... l&lang=eng

moore101 · #7 Post by **moore101** » Thu Aug 10, 2006 3:04 am

I applied the updated intel drivers and the wireless connection has become unstable. Access connections will "turn the radio off" out of the blue but the connection will still be active then after a few minutes windows will drop the connection. And the Fn+F5 radio control has become flakey. Classic problem with incompatible drivers.

Here is the response from our Lenovo rep who basically said they will release updated drivers around August 15th.

"As you may be aware, there has been recent publicity regarding a potential security exposure with wireless lan device drivers, and more specifically, Intel wireless lan device drivers. The exposure could allow an attacker to exploit the vulnerability for remote code execution and system control. This flaw was found by an independent security organization and no instances of customer exploits have been reported. The Lenovo development team has been working with Intel to provide updated drivers that fix the problem. Our plan is to validate the new drivers on our systems and make them available for web download no later than August 15.
The updates will also be available as part of Lenovo's automated Software Update Utilities. Preloads on new systems will be updated with the new drivers.

The systems affected include all ThinkPad systems using one of the following Intel adapters:

Intel Pro-Wireless 2100B minipci adapter
Intel Pro-Wireless 2200BG minipci adapter
Intel Pro-Wireless 2915ABG minipci adapter
Intel Pro-Wireless 3945ABG minipci express adapter

We are not aware of any exposure on Lenovo (Atheros) branded wireless adapters but the engineering team is currently doing an evaluation to see if one exists. If it is determined that these adapters have the exposure we will follow a similar process to provide updates for affected systems."

Puppy · #8 Post by **Puppy** » Wed Aug 23, 2006 2:06 am

Still no new drivers via Software Installer (R51).

masterus · #9 Post by **masterus** » Thu Aug 24, 2006 8:57 am

Hi

Here you can find latest drivers which solve problem (hacking systems by pretending hot-spots) link

Regards

henri · #10 Post by **henri** » Tue Aug 29, 2006 8:46 am

Where can I find the drivers only? The package linked above is 50MB!

#11 Post by **GomJabbar** » Tue Aug 29, 2006 9:08 am

henri wrote:Where can I find the drivers only? The package linked above is 50MB!

You just need to read the page more carefully.

henri · #12 Post by **henri** » Tue Aug 29, 2006 11:04 am

I must learn to scroll down all the way

K0LO · #13 Post by **K0LO** » Sun Sep 03, 2006 9:48 pm

Lenovo released the updated Intel Centrino Wireless Drivers (for the X41T, at least) on September 1, 2006. This version (10.5.0.0 API) contains the fix for the security vulnerability.

You can install this update via the Software Installer. For me, at least, the update was applied successfully and the Fn-F5 key still works as it is supposed to after the update.

Puppy · #14 Post by **Puppy** » Mon Sep 04, 2006 6:29 am

k0lo wrote:You can install this update via the Software Installer. For me, at least, the update was applied successfully and the Fn-F5 key still works as it is supposed to after the update.

Did it automatically uninstall previous 9.x version ? Software Installer does not indicate that the 10.x version is update of 9.x. It shows it as a separate driver to install. Should I remove older 9.x version manually before installing the new one ? I already installed Access Connections 4.12

#15 Post by **GomJabbar** » Mon Sep 04, 2006 6:44 am

Anytime I update the wireless driver, I uninstall Access Connections first, reboot, uninstall the wireless driver, reboot, then install the new wireless driver, reboot, then reinstall Access Connections, and do a final reboot. Less apt to have a problem that way. Using Software Installer for the uninstalls and installations is fine.

K0LO · #16 Post by **K0LO** » Mon Sep 04, 2006 7:19 am

Also had the same problem with Software Installer wanting to install a 9.xxx version of Intel Wireless. I did the following:

1. Download the 10.5.0.0 API version from Lenovo's web site to your desktop. Note the fine print that specifies which versions of Hotkey Driver (and Tablet Shortcut menu if you have a Tablet PC) are required. Download these also if needed.
2. Double-click on the package to extract the files. The installer will put them in C:\Drivers\
3. Using Software Installer, uninstall your current Wireless Driver (and Hotkey driver if you're updating that also).
4. Reboot.
5. Using Software Installer, install the new Wireless driver. It will find the 10.5.0.0 API version when it searches your C:\Drivers folder.
6. Reboot.
7. Using Software Installer, install the new Hotkey driver, if applicable.
8. Done.

#17 Post by **GomJabbar** » Mon Sep 04, 2006 9:29 am

I guess I left out this step. After uninstalling the wireless driver, but before installing the new wireless driver, I also delete the C:\DRIVERS\WIN\WLANINT folder. That way I do not have any older wireless driver leftovers. Sometimes this is the cause of Software Installer seeing 2 versions of drivers.

Puppy · #18 Post by **Puppy** » Wed Sep 06, 2006 7:10 am

Thanks, you were right. Uninstalling both old driver and Access Connections was the only way to get the new driver installed and displayed in Software Installer correctly. Trying to update the driver only messed up the Installer list showing two similar wireless driver items.

Serious Intel PROset/Wireless Software vulnerabilities

Serious Intel PROset/Wireless Software vulnerabilities

Updates coming - maybe

Where to find drivers only?

Re: Where to find drivers only?

Who is online