CVE-2016-4476 — Improper Input Validation in Hostapd

CWE-20 — Improper Input ValidationCWE-88 — Argument Injection12 documents8 sources
Severity
7.5HIGHNVD
EPSS
0.6%
top 30.21%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
W1.fi HostapdW1.fi WPA SupplicantCanonical Ubuntu Linux
Timeline
PublishedMay 9
Latest updateMay 13

Description

hostapd 0.6.7 through 2.5 and wpa_supplicant 0.6.7 through 2.5 do not reject \n and \r characters in passphrase parameters, which allows remote attackers to cause a denial of service (daemon outage) via a crafted WPS operation.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶NVDw1.fi/hostapd0.6.7 — 2.5
▶NVDw1.fi/wpa_supplicant0.6.7 — 2.5

Also affects: Ubuntu Linux 14.04, 16.04, 17.04

🔴Vulnerability Details

4
GHSA
GHSA-p986-2574-rgvr: hostapd 0↗2022-05-13
▶
OSV
wpa vulnerabilities↗2017-10-16
▶
CVEList
CVE-2016-4476: hostapd 0↗2016-05-09
▶
OSV
CVE-2016-4476: hostapd 0↗2016-05-09
▶

📋Vendor Advisories

3
Ubuntu
wpa_supplicant and hostapd vulnerabilities↗2017-10-16
▶
Red Hat
hostapd: denial of service via crafted WPA/WPA2 passphrase parameter↗2016-05-02
▶
Debian
CVE-2016-4476: wpa - hostapd 0.6.7 through 2.5 and wpa_supplicant 0.6.7 through 2.5 do not reject \n ...↗2016
▶

💬Community

4
Bugzilla
CVE-2016-4476 CVE-2016-4477 wpa_supplicant: various flaws [fedora-all]↗2016-05-03
▶
Bugzilla
CVE-2016-4476 wpa_supplicant, hostapd: denial of service via crafted WPA/WPA2 passphrase parameter [fedora-all]↗2016-05-03
▶
Bugzilla
CVE-2016-4476 wpa_supplicant, hostapd: denial of service via crafted WPA/WPA2 passphrase parameter↗2016-05-03
▶
Bugzilla
CVE-2016-4476 wpa_supplicant, hostapd: denial of service via crafted WPA/WPA2 passphrase parameter [epel-all]↗2016-05-03
▶
CVE-2016-4476 — Improper Input Validation in Hostapd | cvebase