hostapd/wpa_supplicant EAP-PWD improper authentication

Summaryinfo

A vulnerability classified as critical has been found in hostapd and wpa_supplicant. Affected by this issue is some unknown functionality of the component EAP-PWD. The manipulation leads to improper authentication. This vulnerability is referenced as CVE-2019-9497. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability was found in hostapd and wpa_supplicant (version now known) and classified as critical. This issue affects some unknown processing of the component EAP-PWD. The manipulation with an unknown input leads to a improper authentication vulnerability. Using CWE to declare the problem leads to CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

The implementations of EAP-PWD in hostapd EAP Server and wpa_supplicant EAP Peer do not validate the scalar and element values in EAP-pwd-Commit. This vulnerability may allow an attacker to complete EAP-PWD authentication without knowing the password. However, unless the crypto library does not implement additional checks for the EC point, the attacker will not be able to derive the session key or complete the key exchange. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.4 are affected. Both hostapd with EAP-pwd support and wpa_supplicant with EAP-pwd support prior to and including version 2.7 are affected.

The bug was discovered 04/10/2019. The weakness was published 04/17/2019 by Joshua (Website). It is possible to read the advisory at w1.fi. The identification of this vulnerability is CVE-2019-9497 since 03/01/2019. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. The technical details are unknown and an exploit is not publicly available.

The vulnerability was handled as a non-public zero-day exploit for at least 7 days. During that time the estimated underground price was around $0-$5k. The commercial vulnerability scanner Qualys is able to test this issue with plugin 197427 (Ubuntu Security Notification for wpa_supplicant and hostapd vulnerabilities (USN-3944-1)).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 71796†). Similar entries are available at VDB-73689, VDB-132130, VDB-133473 and VDB-133472. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• hostapd
• wpa_supplicant

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion