Improper Authentication in busybox (Alpine package)

1) Improper Authentication

EUVDB-ID: #VU23962

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-9497

CWE-ID: CWE-287 - Improper Authentication

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to the implementations of EAP-PWD in hostapd EAP Server and wpa_supplicant EAP Peer do not validate the scalar and element values in EAP-pwd-Commit. A remote attacker can complete EAP-PWD authentication without knowing the password and gain unauthorized access to the application.

However, unless the crypto library does not implement additional checks for the EC point, the attacker will not be able to derive the session key or complete the key exchange.

This vulnerability affects the following products:

• hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.4

• hostapd with EAP-pwd support and wpa_supplicant with EAP-pwd support prior to and including version 2.7
  

Mitigation

Install update from vendor's website.

Vulnerable software versions

busybox (Alpine package): 1.31.1-r16 - 1.31.1-r21

busybox (Alpine package):

External links

http://git.alpinelinux.org/aports/commit/?id=76077dfdd8d77220a469c5743b7b7fd3484300a1

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.