PT-2019-2180 · Linux+5 · Wpa Supplicant+6
Publicado
2019-04-10
·
Atualizado
2024-06-15
·
CVE-2019-9495
CVSS v2.0
4.3
Média
| Vetor | AV:N/AC:M/Au:N/C:P/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
hostapd and wpa supplicant with EAP-PWD support (affected versions not specified)
Description
The issue is related to the implementations of EAP-PWD in hostapd and wpa supplicant, which are vulnerable to side-channel attacks due to cache access patterns. This vulnerability requires the ability to install and execute applications for a successful attack. Memory access patterns are visible in a shared cache, which may allow weak passwords to be cracked.
Recommendations
For hostapd and wpa supplicant with EAP-PWD support, consider disabling EAP-PWD support until a patch is available.
As a temporary workaround, restrict access to shared cache to minimize the risk of exploitation.
Avoid using weak passwords in the affected systems until the issue is resolved.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
DoS
Use of a Broken Cryptographic Algorithm
Side Channel Attack
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Fortios
Freebsd
Suse
Ubuntu
Hostapd
Wpa Supplicant