Vulnerabilities > CVE-2019-10064 - Insufficient Entropy vulnerability in multiple products

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
HIGH
network
low complexity
w1-fi
debian
CWE-331
nessus
NVD
Published: 2020-02-28
Updated: 2024-11-21

Summary

hostapd before 2.6, in EAP mode, makes calls to the rand() and random() standard library functions without any preceding srand() or srandom() call, which results in inappropriate use of deterministic values. This was fixed in conjunction with CVE-2016-10743.

Vulnerable Configurations

Part Description Count
Application
W1.Fi
45
OS
Debian
2

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Session Credential Falsification through Prediction
    This attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.

Nessus

NASL familyDebian Local Security Checks
NASL idDEBIAN_DLA-2138.NASL
descriptionSimilar to CVE-2016-10743 the host access point daemon, hostapd, in EAP mode used a low quality pseudorandom number generator that leads to insufficient entropy. The problem was resolved by using the os_get_random function which provides cryptographically strong pseudo random data. For Debian 8
last seen2020-03-17
modified2020-03-12
plugin id134430
published2020-03-12
reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
sourcehttps://www.tenable.com/plugins/nessus/134430
titleDebian DLA-2138-1 : wpa security update

References