p PatchFirst

CVE-2019-5061

CVE-2019-5061

This page contains facts from public vulnerability sources. Check the original advisory before updating.

An exploitable denial-of-service vulnerability exists in the hostapd 2.6, where an attacker could trigger AP to send IAPP location updates for stations, before the required authentication process has completed. This could lead to different denial of service scenarios, either by causing CAM table attacks, or by leading to traffic flapping if faking already existing clients in other nearby Aps of the same wireless infrastructure. An attacker can forge Authentication and Association Request packets to trigger this vulnerability.

CVSS 7.4 · High · EPSS 0.9% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • w1.f1

    Versions
    • hostapd version 2.6 Ubiquiti AP-AC-Pro firmware 4.0.10.9653: Affected

    No fix published

  • wpa Debian:12

    Affected ranges
    • ECOSYSTEM: < 2:2.9+git20200213+877d9a0-1

    Update to 2:2.9+git20200213+877d9a0-1

  • wpa Debian:13

    Affected ranges
    • ECOSYSTEM: < 2:2.9+git20200213+877d9a0-1

    Update to 2:2.9+git20200213+877d9a0-1

  • wpa Debian:14

    Affected ranges
    • ECOSYSTEM: < 2:2.9+git20200213+877d9a0-1

    Update to 2:2.9+git20200213+877d9a0-1

  • wpa Ubuntu:Pro:14.04:LTS

    Versions
    • 1.0-3ubuntu2
    • 1.0-3ubuntu3
    • 1.0-3ubuntu4
    • 2.1-0ubuntu1
    • 2.1-0ubuntu1.1
    • 2.1-0ubuntu1.2
    • 2.1-0ubuntu1.3
    • 2.1-0ubuntu1.4
    • 2.1-0ubuntu1.5
    • 2.1-0ubuntu1.6
    • 2.1-0ubuntu1.7
    • 2.1-0ubuntu1.7+esm1
    • 2.1-0ubuntu1.7+esm2
    • 2.1-0ubuntu1.7+esm3
    • 2.1-0ubuntu1.7+esm4
    • 2.1-0ubuntu1.7+esm5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • wpa Ubuntu:16.04:LTS

    Versions
    • 2.4-0ubuntu3
    • 2.4-0ubuntu4
    • 2.4-0ubuntu5
    • 2.4-0ubuntu6
    • 2.4-0ubuntu6.2
    • 2.4-0ubuntu6.3
    • 2.4-0ubuntu6.4
    • 2.4-0ubuntu6.5
    • 2.4-0ubuntu6.6
    • 2.4-0ubuntu6.7
    • 2.4-0ubuntu6.8
    • 2.4-0ubuntu6.8+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • wpa Ubuntu:18.04:LTS

    Versions
    • 2.4-0ubuntu10
    • 2:2.4-1.1ubuntu1
    • 2:2.6-15ubuntu1
    • 2:2.6-15ubuntu2
    • 2:2.6-15ubuntu2.1
    • 2:2.6-15ubuntu2.2
    • 2:2.6-15ubuntu2.3
    • 2:2.6-15ubuntu2.4
    • 2:2.6-15ubuntu2.5
    • 2:2.6-15ubuntu2.6
    • 2:2.6-15ubuntu2.7
    • 2:2.6-15ubuntu2.8
    • 2:2.6-15ubuntu2.8+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • wpa Ubuntu:20.04:LTS

    Versions
    • 2:2.9-1ubuntu2
    • 2:2.9-1ubuntu3
    • 2:2.9-1ubuntu4
    • 2:2.9-1ubuntu4.1
    • 2:2.9-1ubuntu4.2
    • 2:2.9-1ubuntu4.3
    • 2:2.9-1ubuntu4.4
    • 2:2.9-1ubuntu4.6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →