A vulnerability has been found in Hostapd up to 2.5 and classified as problematic. This vulnerability affects an unknown function of the component IAPP Location Update Handler. The manipulation as part of a Request leads to a input validation vulnerability. The CWE definition for the vulnerability is CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. As an impact it is known to affect availability. CVE summarizes:

An exploitable denial-of-service vulnerability exists in the hostapd 2.6, where an attacker could trigger AP to send IAPP location updates for stations, before the required authentication process has completed. This could lead to different denial of service scenarios, either by causing CAM table attacks, or by leading to traffic flapping if faking already existing clients in other nearby Aps of the same wireless infrastructure. An attacker can forge Authentication and Association Request packets to trigger this vulnerability.

The weakness was shared 12/12/2019. This vulnerability was named CVE-2019-5061 since 01/04/2019. The attack needs to approached within the local network. No form of authentication is required for a successful exploitation. The technical details are unknown and an exploit is not available.

Upgrading to version 2.6 eliminates this vulnerability.

The entry VDB-147155 is related to this item. Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• Hostapd

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion