Improper Authentication in hostapd and wpa_supplicant - CVE-2019-9497

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU23962

Improper Authentication in hostapd and wpa_supplicant - CVE-2019-9497

Published: January 6, 2020


Vulnerability identifier: #VU23962
CSH Severity: High
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2019-9497
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vendor: Jouni Malinen
Affected software:
hostapd
wpa_supplicant

Detailed vulnerability description

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to the implementations of EAP-PWD in hostapd EAP Server and wpa_supplicant EAP Peer do not validate the scalar and element values in EAP-pwd-Commit. A remote attacker can complete EAP-PWD authentication without knowing the password and gain unauthorized access to the application.

However, unless the crypto library does not implement additional checks for the EC point, the attacker will not be able to derive the session key or complete the key exchange.

This vulnerability affects the following products:

  • hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.4
  • hostapd with EAP-pwd support and wpa_supplicant with EAP-pwd support prior to and including version 2.7

How to mitigate CVE-2019-9497

Install updates from vendor's website.

Sources