CVE-2019-9496— An invalid authentication sequence could result in the hostapd process terminating due to missing state validation steps
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2019-9496
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
An invalid authentication sequence could result in the hostapd process terminating due to missing state validation steps
Source: NVD (National Vulnerability Database)
Vulnerability Description
An invalid authentication sequence could result in the hostapd process terminating due to missing state validation steps when processing the SAE confirm message when in hostapd/AP mode. All version of hostapd with SAE support are vulnerable. An attacker may force the hostapd process to terminate, performing a denial of service attack. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.7 are affected.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
对关键状态数据的外部可控制
Source: NVD (National Vulnerability Database)
Vulnerability Title
hostapd 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
hostapd是一款访问点和身份验证服务器的用户空间守护程序。 hostapd中存在安全漏洞。攻击者可利用该漏洞造成拒绝服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Wi-Fi Alliance | hostapd with SAE support | 2.7 ~ 2.7 | - | |
| Wi-Fi Alliance | wpa_supplicant with SAE support | 2.7 ~ 2.7 | - |
II. Public POCs for CVE-2019-9496
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2019-9496
Please Login to view more intelligence information
- https://w1.fi/security/2019-3/x_refsource_CONFIRM
- https://www.synology.com/security/advisory/Synology_SA_19_16x_refsource_CONFIRM
- http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00021.htmlvendor-advisoryx_refsource_SUSE
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVMJOFEYBGXZLFF5IOLW67SSOPKFEJP3/vendor-advisoryx_refsource_FEDORA
- https://nvd.nist.gov/vuln/detail/CVE-2019-9496
Same Patch Batch · Wi-Fi Alliance · 2019-04-17 · 6 CVEs total
| CVE-2019-9494 | The implementations of SAE in hostapd and wpa_supplicant are vulnerable to side-channel at | |
| CVE-2019-9495 | The implementations of EAP-PWD in hostapd and wpa_supplicant are vulnerable to side-channe | |
| CVE-2019-9497 | The implementations of EAP-PWD in hostapd EAP Server and wpa_supplicant EAP Peer do not va | |
| CVE-2019-9498 | The implementations of EAP-PWD in hostapd EAP Server do not validate the scalar and elemen | |
| CVE-2019-9499 | The implementations of EAP-PWD in wpa_supplicant EAP Peer do not validate the scalar and e |
IV. Related Vulnerabilities
Same vendor: Wi-Fi Alliance
- CVE-2019-9494
The implementations of SAE in hostapd and wpa_supplicant are - CVE-2019-9497
The implementations of EAP-PWD in hostapd EAP Server and wpa - CVE-2019-9498
The implementations of EAP-PWD in hostapd EAP Server do not - CVE-2019-9495
The implementations of EAP-PWD in hostapd and wpa_supplicant - CVE-2019-9499
The implementations of EAP-PWD in wpa_supplicant EAP Peer do
V. Comments for CVE-2019-9496
No comments yet