Podatność CVE-2017-13081

Podatność CVE-2017-13081

Publikacja: 2017-10-17

Opis:

Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11w allows reinstallation of the Integrity Group Temporal Key (IGTK) during the group key handshake, allowing an attacker within radio range to spoof frames from access points to clients.

Typ:

CWE-330

(Use of Insufficiently Random Values)

CVSS2 => (AV:A/AC:M/Au:N/C:N/I:P/A:N)

Ogólna skala CVSS	Znaczenie	Łatwość wykorzystania
2.9/10	2.9/10	5.5/10

Wymagany dostęp	Złożoność ataku	Autoryzacja
Sieć lokalna	Średnia	Nie wymagana
Wpływ na poufność	Wpływ na integralność	Wpływ na dostępność
Brak	Częściowy	Brak

Affected software
W1.fi -> Hostapd
W1.fi -> Wpa supplicant
SUSE -> Linux enterprise desktop
SUSE -> Linux enterprise point of sale
SUSE -> Linux enterprise server
SUSE -> Openstack cloud
Redhat -> Enterprise linux desktop
Redhat -> Enterprise linux server
Opensuse -> LEAP
Freebsd -> Freebsd
Debian -> Debian linux
Canonical -> Ubuntu linux

Referencje:

http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00020.html

http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00023.html

http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00024.html

http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-007.txt

http://www.debian.org/security/2017/dsa-3999

http://www.kb.cert.org/vuls/id/228519

http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html

http://www.securityfocus.com/bid/101274

http://www.securitytracker.com/id/1039573

http://www.securitytracker.com/id/1039576

http://www.securitytracker.com/id/1039577

http://www.securitytracker.com/id/1039578

http://www.securitytracker.com/id/1039581

http://www.securitytracker.com/id/1039585

http://www.ubuntu.com/usn/USN-3455-1

https://access.redhat.com/security/vulnerabilities/kracks

https://cert.vde.com/en-us/advisories/vde-2017-005

https://cert-portal.siemens.com/productcert/pdf/ssa-901333.pdf

https://lists.debian.org/debian-lts-announce/2018/11/msg00015.html

https://security.FreeBSD.org/advisories/FreeBSD-SA-17:07.wpa.asc

https://security.gentoo.org/glsa/201711-03

https://source.android.com/security/bulletin/2017-11-01

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03792en_us

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171016-wpa

https://w1.fi/security/2017-1/wpa-packet-number-reuse-with-replayed-messages.txt

https://www.krackattacks.com/

Podatność CVE-2017-13081

Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11w allows reinstallation of the Integrity Group Temporal Key (IGTK) during the group key handshake, allowing an attacker within radio range to spoof frames from access points to clients.

CWE-330

CVSS2 => (AV:A/AC:M/Au:N/C:N/I:P/A:N)

2.9/10

2.9/10

5.5/10

Sieć lokalna

Średnia

Nie wymagana

Brak

Częściowy

Brak

Affected software

Referencje: