Critical Vulnerability in Hostapd: CallStranger Issue Exposed
Summary
ALPINE-CVE-2020-12695: The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscriptio... Affects hostapd versions < 2.8-r3. Fixed in 2.8-r3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Hostapd is a user-space daemon that allows access point and authentication server functionalities for wireless networks. It is widely used in various Linux distributions, including Alpine Linux, to manage Wi-Fi connections and provide secure authentication. The vulnerability in question arises from the Open Connectivity Foundation's UPnP specification, which Hostapd implements, leading to potential security risks if not addressed.
Vulnerability Detail
The vulnerability, identified as CVE-2020-12695, allows an attacker to exploit the UPnP specification by sending a subscription request with a delivery URL that resides on a different network segment than the fully qualified event-subscription URL. This could lead to unauthorized access to sensitive data or control over devices on the network. The issue stems from a lack of restrictions in the UPnP specification, which was not adequately enforced in Hostapd versions prior to the patches.
How To Fix
Minimum fixed version
2.8-r3
This is the first release that contains the fix.
sudo apk add --upgrade hostapdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, network administrators can restrict access to the UPnP services or implement firewall rules to limit exposure to potential attackers. Additionally, disabling UPnP on devices that do not require it can mitigate risks.
Conclusion
The CVE-2020-12695 vulnerability in Hostapd poses significant risks to network security due to improper handling of UPnP subscription requests. It is crucial for users to update their Hostapd installations to the latest patched versions to mitigate these risks. Implementing additional security measures can further protect against potential exploitation.
See every vulnerability recorded for hostapd →
FAQ
CVE-2020-12695 is a vulnerability in the Hostapd package that allows unauthorized subscription requests due to improper handling of delivery URLs in the UPnP specification.
This vulnerability can allow attackers to gain unauthorized access to devices on your network, potentially leading to data breaches or control over networked devices.
Affected versions include Hostapd versions prior to 2.8-r3 for Alpine v3.10 and 2.9-r2 for Alpine v3.11 and later.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of CVE-2020-12695 is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for hostapd.
