ThinkSECURE has discovered that certain well-known wireless chipsets, using vulnerable drivers under the Windows XP operating system and when configured to use WEP with Open Authentication, can be tricked by a 802.11-based wireless client adapter operating in master mode (“the attacker”) to discard the WEP settings and negotiate a post-association connection with the attacker in the clear.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/43250/thinksecureWEP.txt
Source: https://packetstormsecurity.com/files/43250/thinksecureWEP.txt.html