PT-2019-6124 · Linux+4 · Wpa Supplicant+5
Publicado
2019-04-10
·
Atualizado
2024-06-15
·
CVE-2019-9496
CVSS v3.1
7.5
Alta
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
hostapd versions with SAE support
wpa supplicant versions prior to and including 2.7
Description
The issue is related to an invalid authentication sequence that could result in the hostapd process terminating due to missing state validation steps when processing the SAE confirm message. This can be exploited by an attacker to force the hostapd process to terminate, resulting in a denial of service attack. The problem is associated with the implementation of the SAE function in wpa supplicant for WPA wireless communication device certification, which is linked to incorrect authentication sequences.
Recommendations
For hostapd with SAE support, consider disabling SAE support as a temporary workaround until a patch is available.
For wpa supplicant versions prior to and including 2.7, update to a version later than 2.7 to resolve the issue.
As a temporary mitigation measure for wpa supplicant, restrict the use of SAE functionality until an update can be applied.
Correção
DoS
Improper Authentication
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Fortios
Freebsd
Suse
Hostapd
Wpa Supplicant