CVE-2019-10064

Summary

hostapd before 2.6, in EAP mode, makes calls to the rand() and random() standard library functions without any preceding srand() or srandom() call, which results in inappropriate use of deterministic values. This was fixed in conjunction with CVE-2016-10743.

Affected Software

Weaknesses

• n/a

ADP Enrichment

CVE Program Container

Additional References

• https://w1.fi/cgit/hostap/commit/?id=98a516eae8260e6fd5c48ddecf8d006285da7389
• http://www.openwall.com/lists/oss-security/2020/02/27/1
• http://www.openwall.com/lists/oss-security/2020/02/27/2
• http://seclists.org/fulldisclosure/2020/Feb/26
• http://www.openwall.com/lists/oss-security/2020/02/27/1
• http://packetstormsecurity.com/files/156573/Hostapd-Insufficient-Entropy.html
• https://lists.debian.org/debian-lts-announce/2020/03/msg00010.html
• https://lists.debian.org/debian-lts-announce/2020/08/msg00013.html

References

• https://w1.fi/cgit/hostap/commit/?id=98a516eae8260e6fd5c48ddecf8d006285da7389
• http://www.openwall.com/lists/oss-security/2020/02/27/1
• http://www.openwall.com/lists/oss-security/2020/02/27/2
• http://seclists.org/fulldisclosure/2020/Feb/26
• http://www.openwall.com/lists/oss-security/2020/02/27/1
• http://packetstormsecurity.com/files/156573/Hostapd-Insufficient-Entropy.html
• https://lists.debian.org/debian-lts-announce/2020/03/msg00010.html
• https://lists.debian.org/debian-lts-announce/2020/08/msg00013.html

• ←Previous
• Next→