PT-2020-5620 · Hostap+1 · Hostapd+1

Jonathan Brossard · Published 2016-12-23 · Updated 2022-01-01 · CVE-2019-10064

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions hostapd versions prior to 2.6

Description The issue is related to the use of deterministic values due to missing calls to srand() or srandom() before using rand() and random() standard library functions in EAP mode. This results in inappropriate use of deterministic values. The vulnerability is also related to a lack of entropy in PIN selection for WPA wireless network device certification, which can be exploited by a remote attacker to cause a denial of service.

Recommendations For hostapd versions prior to 2.6, update to version 2.6 or later to resolve the issue. As a temporary workaround, consider disabling the use of rand() and random() functions in EAP mode until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-331

Related Identifiers

ALT-PU-2016-2481

BDU:2021-01305

CVE-2019-10064

DLA-2138-1

DLA-2318-1

Affected Products

Alt Linux

Hostapd

References · 24

• 🔥 http://packetstormsecurity.com/files/156573/Hostapd-Insufficient-Entropy.html · Exploit
• 🔥 http://openwall.com/lists/oss-security/2020/02/27/1 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2020/Feb/26 · Exploit
• https://bdu.fstec.ru/vul/2021-01305 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-10064 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10064 · Security Note
• https://w1.fi/cgit/hostap/commit/?id=98a516eae8260e6fd5c48ddecf8d006285da7389 · Patch
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20210611SE16 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-10064 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-10064 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-10064 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2318-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-10064 · Security Note
• https://osv.dev/vulnerability/CVE-2019-10064 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2138-1 · Vendor Advisory