Vulnerabilities > CVE-2019-10064 - Insufficient Entropy vulnerability in multiple products

CVSS 5.0 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

PARTIAL

network

low complexity

w1-fi

debian

CWE-331

nessus

NVD

Published: 2020-02-28

Updated: 2022-01-01

Summary

hostapd before 2.6, in EAP mode, makes calls to the rand() and random() standard library functions without any preceding srand() or srandom() call, which results in inappropriate use of deterministic values. This was fixed in conjunction with CVE-2016-10743.

Vulnerable Configurations

Part	Description	Count
Application	W1.Fi W1.Fi Hostapd 0.2.0 W1.Fi Hostapd 0.2.1 W1.Fi Hostapd 0.2.2 W1.Fi Hostapd 0.2.4 W1.Fi Hostapd 0.3.0 W1.Fi Hostapd 0.3.1 W1.Fi Hostapd 0.3.2 W1.Fi Hostapd 0.3.3 W1.Fi Hostapd 0.3.4 W1.Fi Hostapd 0.3.5 W1.Fi Hostapd 0.3.7 W1.Fi Hostapd 0.4.0 W1.Fi Hostapd 0.4.1 W1.Fi Hostapd 0.4.2 W1.Fi Hostapd 0.4.3 W1.Fi Hostapd 0.4.4 W1.Fi Hostapd 0.4.5 W1.Fi Hostapd 0.4.6 W1.Fi Hostapd 0.4.7 W1.Fi Hostapd 0.5.0 W1.Fi Hostapd 0.5.1 W1.Fi Hostapd 0.5.2 W1.Fi Hostapd 0.5.3 W1.Fi Hostapd 0.5.4 W1.Fi Hostapd 0.5.5 W1.Fi Hostapd 0.5.6 W1.Fi Hostapd 0.6.0 W1.Fi Hostapd 0.6.1 W1.Fi Hostapd 0.6.2 W1.Fi Hostapd 0.6.3 W1.Fi Hostapd 0.6.4 W1.Fi Hostapd 0.6.5 W1.Fi Hostapd 0.6.6 W1.Fi Hostapd 0.6.7 W1.Fi Hostapd 0.7.0 W1.Fi Hostapd 0.7.1 W1.Fi Hostapd 0.7.2 W1.Fi Hostapd 0.7.3 W1.Fi Hostapd 1.1 W1.Fi Hostapd 2.0 W1.Fi Hostapd 2.1 W1.Fi Hostapd 2.2 W1.Fi Hostapd 2.3 W1.Fi Hostapd 2.4 W1.Fi Hostapd 2.5	45
OS	Debian Debian Debian Linux 8.0 Debian Debian Linux 9.0	2

Common Weakness Enumeration (CWE)

CWE-331 - Insufficient Entropy

Common Attack Pattern Enumeration and Classification (CAPEC)

Session Credential Falsification through Prediction
This attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.

Nessus

NASL family	Debian Local Security Checks
NASL id	DEBIAN_DLA-2138.NASL
description	Similar to CVE-2016-10743 the host access point daemon, hostapd, in EAP mode used a low quality pseudorandom number generator that leads to insufficient entropy. The problem was resolved by using the os_get_random function which provides cryptographically strong pseudo random data. For Debian 8
last seen	2020-03-17
modified	2020-03-12
plugin id	134430
published	2020-03-12
reporter	This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/134430
title	Debian DLA-2138-1 : wpa security update

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

Nessus

References