[SECURITY] [DLA 1867-1] wpa security update

Package : wpa Version : 2.3-1+deb8u8 CVE ID : CVE-2019-9495 CVE-2019-9497 CVE-2019-9498 CVE-2019-9499 CVE-2019-11555 Debian Bug : 927463 Several vulnerabilities were discovered in WPA supplicant / hostapd. Some of them could only partially be mitigated, please read below for details. CVE-2019-949...

freeradius:3.0 security update

3.0.17-4 - Fixes two EAP-PWD security issues Resolves: bz1699416 authentication bypass with an invalid curve attack...

CVE-2019-11232

EXCELLENT INFOTEK BiYan v1.57 v2.8 allows an attacker to leak user information Password without being authenticated, by sending an EMPNO element to the kwslogin/asp/queryuser.asp URI, and then reading the PWD element...

CVE-2019-11232

EXCELLENT INFOTEK BiYan v1.57 v2.8 allows an attacker to leak user information Password without being authenticated, by sending an EMPNO element to the kwslogin/asp/queryuser.asp URI, and then reading the PWD element...

The vulnerability of the wpa_supplicant component of the EAP-PWD protocol in wireless communication devices certified by WPA allows a perpetrator to compromise the integrity and confidentiality of data or cause service failures due to improper use of privileges.

The vulnerability of the wpasupplicant component of the EAP-PWD protocol in wireless communication devices certified by WPA is related to incorrect validation of scalar values and values of elements in the “EAP-pwd-Commit” section of imported elements. Exploiting this vulnerability allows a...

EulerOS 2.0 SP5 : freeradius (EulerOS-SA-2019-1574)

According to the version of the freeradius package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - freeradius: eap-pwd: fake authentication using reflection CVE-2019-11234 Note that Tenable Network Security has extracted the preceding...

Debian DSA-4450-1 : wpa - security update

A vulnerability was found in the WPA protocol implementation found in wpasupplication station and hostapd access point. The EAP-pwd implementation in hostapd EAP server and wpasupplicant EAP peer doesn't properly validate fragmentation reassembly state when receiving an unexpected fragment. This...

Debian: Security Advisory (DSA-4450-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DSA 4450-1] wpa security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4450-1 [email protected] https://www.debian.org/security/ Yves-Alexis Perez May 24, 2019 https://www.debian.org/security/faq -...

Updated freeradius packages fix security vulnerability

An attacker can reflect the received scalar and element from the server in it's own commit message, and subsequently reflect the confirm value as well. This causes the adversary to successfully authenticate as the victim CVE-2019-11234. An invalid curve attack allows an attacker to authenticate a...

CentOS Update for freeradius CESA-2019:1131 centos7

The remote host is missing an update for the SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE Security Update : freeradius-server (openSUSE-2019-1394)

This update for freeradius-server fixes the following issues : Security issues fixed : - CVE-2019-11235: Fixed an authentication bypass related to the EAP-PWD Commit frame and insufficent validation of elliptic curve points bsc1132549. - CVE-2019-11234: Fixed an authentication bypass caused by...

freeradius: eap-pwd: fake authentication using reflection

FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing, aka a "Dragonblood" issue, a similar issue to CVE-2019-9497...

CyberArk Enterprise Password Vault 10.7 - XML External Entity Injection Vulnerability

Exploit for multiple platform in category web applications Exploit Title: CyberArk XML External Entity XXE Injection in SAML authentication Exploit Author: Marcelo Toran @spamv Vendor Homepage: https://www.cyberark.com Version: =10.7 CVE : CVE-2019-7442 -----------Product description The CyberArk...

Ubuntu 14.04 LTS : wpa vulnerability (USN-3969-2)

USN-3969-1 fixed a vulnerability in wpasupplicant and hostapd. This update provides the corresponding update for Ubuntu 14.04 ESM. Original advisory details : It was discovered that wpasupplicant and hostapd incorrectly handled unexpected fragments when using EAP-pwd. A remote attacker could...

freeradius: eap-pwd: fake authentication using reflection

FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing, aka a "Dragonblood" issue, a similar issue to CVE-2019-9497...

USN-3969-2: wpa_supplicant and hostapd vulnerability

USN-3969-1 fixed a vulnerability in wpasupplicant and hostapd. This update provides the corresponding update for Ubuntu 14.04 ESM. Original advisory details: It was discovered that wpasupplicant and hostapd incorrectly handled unexpected fragments when using EAP-pwd. A remote attacker could...

CVE-2019-11555

The EAP-pwd implementation in hostapd EAP server before 2.8 and wpasupplicant EAP peer before 2.8 does not validate fragmentation reassembly state properly for a case where an unexpected fragment could be received. This could result in process termination due to a NULL pointer dereference denial ...

freeradius security update

3.0.13-10 - Fixes two EAP-PWD security issues Resolves: bz1699413 authentication bypass with an invalid curve attack...

openSUSE Security Update : wpa_supplicant (openSUSE-2019-1345)

This update for wpasupplicant fixes the following issues : This security issue was fixed : - CVE-2018-14526: Under certain conditions, the integrity of EAPOL-Key messages was not checked, leading to a decryption oracle. An attacker within range of the Access Point and client could have abused the...