Vulnerability Description
An invalid authentication sequence could result in the hostapd process terminating due to missing state validation steps when processing the SAE confirm message when in hostapd/AP mode. All version of hostapd with SAE support are vulnerable. An attacker may force the hostapd process to terminate, performing a denial of service attack. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.7 are affected.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| W1.Fi | Hostapd | <= 2.7 |
| W1.Fi | Wpa Supplicant | <= 2.7 |
| Fedoraproject | Fedora | 28 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00021.html
- http://packetstormsecurity.com/files/152914/FreeBSD-Security-Advisory-FreeBSD-SA
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://seclists.org/bugtraq/2019/May/40
- https://security.FreeBSD.org/advisories/FreeBSD-SA-19:03.wpa.asc
- https://w1.fi/security/2019-3/PatchVendor Advisory
- https://www.synology.com/security/advisory/Synology_SA_19_16
- http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00021.html
- http://packetstormsecurity.com/files/152914/FreeBSD-Security-Advisory-FreeBSD-SA
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://seclists.org/bugtraq/2019/May/40
FAQ
What is CVE-2019-9496?
CVE-2019-9496 is a vulnerability with a CVSS score of 7.5 (HIGH). An invalid authentication sequence could result in the hostapd process terminating due to missing state validation steps when processing the SAE confirm message when in hostapd/AP mode. All version of...
How severe is CVE-2019-9496?
CVE-2019-9496 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-9496?
Check the references section above for vendor advisories and patch information. Affected products include: W1.Fi Hostapd, W1.Fi Wpa Supplicant, Fedoraproject Fedora.