search

xoseperez / espurna

Home automation firmware for ESP8266-based devices
http://tinkerman.cat
GNU General Public License v3.0
3k stars 638 forks source link

ESP8266 Wi-Fi vulnerabilties (CVE-2019-12586, CVE-2019-12587, CVE-2019-12588) #1897

Closed PieBru closed 4 years ago

PieBru commented 5 years ago

Just a reminder, waiting for Espressif updates for these vulnerabilities.

th0ma5w commented 5 years ago

Thank you for your hard work on this project and making sure to put this note here. I can looking for this. Thanks again!!

mcspr commented 5 years ago

See https://github.com/Matheus-Garbelini/esp32_esp8266_attacks https://github.com/esp8266/Arduino/issues/6436#issuecomment-528192690 https://github.com/esp8266/Arduino/issues/6016#issuecomment-522591603 When using platform = ${common.arduino_core_git} you will build with Espressif SDK that has DoS patches included. Next Core point release (2.6.0) will include those. No WPA2 enterprise fixes, but this mode is supposedly not working anyways with the current NONOS SDK

I wonder if those sdk files could be included with 2.3.0 release builds... Since the only reason for using old Core right now is saving ~30KB of .bin size. Custom build that I use right now is running git version without WebUI package (~60...80KB), which puts it around the same size as older 2.3.0

mcspr commented 4 years ago

Closing via #2333