CVE-2019-16275

Name
CVE-2019-16275
Description
hostapd before 2.10 and wpa_supplicant before 2.10 allow an incorrect indication of disconnection in certain situations because source address validation is mishandled. This is a denial of service that should have been prevented by PMF (aka management frame protection). The attacker must send a crafted 802.11 frame from a location that is within the 802.11 communications range.
NVD Severity
medium
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
Patch https://w1.fi/security/2019-7/
Mailing List https://www.openwall.com/lists/oss-security/2019/09/11/7
Mitigation https://w1.fi/security/2019-7/ap-mode-pmf-disconnection-protection-bypass.txt
Mailing List http://www.openwall.com/lists/oss-security/2019/09/12/6
Mailing List https://lists.debian.org/debian-lts-announce/2019/09/msg00017.html
Third Party Advisory https://usn.ubuntu.com/4136-1/
Third Party Advisory https://usn.ubuntu.com/4136-2/
Third Party Advisory https://www.debian.org/security/2019/dsa-4538
Mailing List https://seclists.org/bugtraq/2019/Sep/56
Mailing List https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/36G4XAZ644DMHBLKOL4FDSPZVIGNQY6U/
Mailing List https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FEGITWRTIWABW54ANEPCEF4ARZLXGSK5/
Mailing List https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PBJXUKV6XMSELWNXPS37CSUIH5EUHFXQ/
Mailing List https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B7NCLOPTZNRRNYODH22BFIDH6YIQWLJD/
Mailing List https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HY6STGJIIROVNIU6VMB2WTN2Q5M65WF4/

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:w1.fi:wpa_supplicant:*:*:*:*:*:*:*:* wpa_supplicant >= None <= 2.9
cpe:2.3:a:w1.fi:hostapd:*:*:*:*:*:*:*:* hostapd >= None <= 2.9

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
wpa_supplicant edge-main 2.9-r17 Natanael Copa <ncopa@alpinelinux.org> fixed
wpa_supplicant edge-main 2.9-r16 Natanael Copa <ncopa@alpinelinux.org> fixed
wpa_supplicant edge-main 2.9-r15 Natanael Copa <ncopa@alpinelinux.org> fixed
wpa_supplicant edge-main 2.9-r14 Natanael Copa <ncopa@alpinelinux.org> fixed
wpa_supplicant edge-main 2.9-r13 Natanael Copa <ncopa@alpinelinux.org> fixed
wpa_supplicant edge-main 2.9-r12 None fixed
wpa_supplicant edge-main 2.9-r10 None fixed
wpa_supplicant edge-main 2.9-r5 None fixed
wpa_supplicant edge-main 2.7-r3 None possibly vulnerable
wpa_supplicant edge-main 2.7-r2 None possibly vulnerable
wpa_supplicant edge-main 2.6-r14 None possibly vulnerable
wpa_supplicant edge-main 2.6-r7 None possibly vulnerable
wpa_supplicant 3.22-main 2.9-r13 None fixed
wpa_supplicant 3.22-main 2.9-r12 None fixed
wpa_supplicant 3.22-main 2.9-r10 None fixed
wpa_supplicant 3.22-main 2.9-r5 None fixed
wpa_supplicant 3.22-main 2.7-r3 None possibly vulnerable
wpa_supplicant 3.22-main 2.7-r2 None possibly vulnerable
wpa_supplicant 3.22-main 2.6-r14 None possibly vulnerable
wpa_supplicant 3.22-main 2.6-r7 None possibly vulnerable
wpa_supplicant 3.21-main 2.9-r13 None fixed
wpa_supplicant 3.21-main 2.9-r12 None fixed
wpa_supplicant 3.21-main 2.9-r10 None fixed
wpa_supplicant 3.21-main 2.9-r5 None fixed
wpa_supplicant 3.21-main 2.7-r3 None possibly vulnerable
wpa_supplicant 3.21-main 2.7-r2 None possibly vulnerable
wpa_supplicant 3.21-main 2.6-r14 None possibly vulnerable
wpa_supplicant 3.21-main 2.6-r7 None possibly vulnerable
wpa_supplicant 3.20-main 2.9-r13 None fixed
wpa_supplicant 3.20-main 2.9-r12 None fixed
wpa_supplicant 3.20-main 2.9-r10 None fixed
wpa_supplicant 3.20-main 2.9-r5 None fixed
wpa_supplicant 3.20-main 2.7-r3 None possibly vulnerable
wpa_supplicant 3.20-main 2.7-r2 None possibly vulnerable
wpa_supplicant 3.20-main 2.6-r14 None possibly vulnerable
wpa_supplicant 3.20-main 2.6-r7 None possibly vulnerable
wpa_supplicant 3.19-main 2.9-r13 None fixed
wpa_supplicant 3.19-main 2.9-r12 None fixed
wpa_supplicant 3.19-main 2.9-r10 None fixed
wpa_supplicant 3.19-main 2.9-r5 None fixed
wpa_supplicant 3.19-main 2.7-r3 None possibly vulnerable
wpa_supplicant 3.19-main 2.7-r2 None possibly vulnerable
wpa_supplicant 3.19-main 2.6-r14 None possibly vulnerable
wpa_supplicant 3.19-main 2.6-r7 None possibly vulnerable
wpa_supplicant 3.18-main 2.9-r5 None fixed
wpa_supplicant 3.17-main 2.9-r5 None fixed
wpa_supplicant 3.12-main 2.9-r8 Natanael Copa <ncopa@alpinelinux.org> fixed
wpa_supplicant 3.12-main 2.9-r5 None fixed
wpa_supplicant 3.11-main 2.9-r8 Natanael Copa <ncopa@alpinelinux.org> fixed
wpa_supplicant 3.11-main 2.9-r5 None fixed
wpa_supplicant 3.10-main 2.8-r3 None fixed
hostapd edge-main 2.9-r6 Natanael Copa <ncopa@alpinelinux.org> fixed
hostapd edge-main 2.9-r5 Natanael Copa <ncopa@alpinelinux.org> fixed
hostapd edge-main 2.9-r4 Natanael Copa <ncopa@alpinelinux.org> fixed
hostapd edge-main 2.9-r3 Natanael Copa <ncopa@alpinelinux.org> fixed
hostapd edge-main 2.9-r2 None fixed
hostapd edge-main 2.9-r1 None fixed
hostapd edge-main 2.8-r0 None possibly vulnerable
hostapd edge-main 2.6-r2 None possibly vulnerable
hostapd 3.22-main 2.9-r3 None fixed
hostapd 3.22-main 2.9-r2 None fixed
hostapd 3.22-main 2.9-r1 None fixed
hostapd 3.22-main 2.8-r0 None possibly vulnerable
hostapd 3.22-main 2.6-r2 None possibly vulnerable
hostapd 3.21-main 2.9-r3 None fixed
hostapd 3.21-main 2.9-r2 None fixed
hostapd 3.21-main 2.9-r1 None fixed
hostapd 3.21-main 2.8-r0 None possibly vulnerable
hostapd 3.21-main 2.6-r2 None possibly vulnerable
hostapd 3.20-main 2.9-r3 None fixed
hostapd 3.20-main 2.9-r2 None fixed
hostapd 3.20-main 2.9-r1 None fixed
hostapd 3.20-main 2.8-r0 None possibly vulnerable
hostapd 3.20-main 2.6-r2 None possibly vulnerable
hostapd 3.19-main 2.9-r3 None fixed
hostapd 3.19-main 2.9-r2 None fixed
hostapd 3.19-main 2.9-r1 None fixed
hostapd 3.19-main 2.8-r0 None possibly vulnerable
hostapd 3.19-main 2.6-r2 None possibly vulnerable
hostapd 3.18-main 2.9-r1 None fixed
hostapd 3.17-main 2.9-r1 None fixed
hostapd 3.12-main 2.9-r4 Natanael Copa <ncopa@alpinelinux.org> fixed
hostapd 3.12-main 2.9-r3 Natanael Copa <ncopa@alpinelinux.org> fixed
hostapd 3.12-main 2.9-r1 None fixed
hostapd 3.11-main 2.9-r3 Natanael Copa <ncopa@alpinelinux.org> fixed
hostapd 3.11-main 2.9-r1 None fixed
hostapd 3.10-main 2.8-r2 None fixed