#VU30346 Insufficient Entropy in hostapd - CVE-2019-10064

Vulnerability identifier: #VU30346

Vulnerability risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2019-10064

CWE-ID: CWE-331

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
hostapd
Server applications / Remote access servers, VPN

Vendor: Jouni Malinen

Description

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

hostapd before 2.6, in EAP mode, makes calls to the rand() and random() standard library functions without any preceding srand() or srandom() call, which results in inappropriate use of deterministic values. This was fixed in conjunction with CVE-2016-10743.

Mitigation
Install update from vendor's website.

Vulnerable software versions

hostapd: 2.0 - 2.5

---

External links
https://packetstormsecurity.com/files/156573/Hostapd-Insufficient-Entropy.html
https://seclists.org/fulldisclosure/2020/Feb/26
https://www.openwall.com/lists/oss-security/2020/02/27/1
https://www.openwall.com/lists/oss-security/2020/02/27/2
https://lists.debian.org/debian-lts-announce/2020/03/msg00010.html
https://w1.fi/cgit/hostap/commit/?id=98a516eae8260e6fd5c48ddecf8d006285da7389

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.