Vulnerability CVE-2017-13082


Published: 2017-10-17

Description:
Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11r allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key (TK) during the fast BSS transmission (FT) handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.

See advisories in our WLB2 database:
Topic
Author
Date
Med.
KRACK Key Reinstall in FT Handshake - PoC
Mathy Vanhoef
19.10.2017

Type:

CWE-330

(Use of Insufficiently Random Values)

CVSS2 => (AV:A/AC:L/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
5.8/10
6.4/10
6.5/10
Exploit range
Attack complexity
Authentication
Adjacent network
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial
Affected software
W1.fi -> Hostapd 
W1.fi -> Wpa supplicant 
SUSE -> Linux enterprise desktop 
SUSE -> Linux enterprise point of sale 
SUSE -> Linux enterprise server 
SUSE -> Openstack cloud 
Redhat -> Enterprise linux desktop 
Redhat -> Enterprise linux server 
Opensuse -> LEAP 
Freebsd -> Freebsd 
Debian -> Debian linux 
Canonical -> Ubuntu linux 

 References:
http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-007.txt
http://www.debian.org/security/2017/dsa-3999
http://www.kb.cert.org/vuls/id/228519
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
http://www.securityfocus.com/bid/101274
http://www.securitytracker.com/id/1039570
http://www.securitytracker.com/id/1039571
http://www.securitytracker.com/id/1039573
http://www.securitytracker.com/id/1039581
http://www.ubuntu.com/usn/USN-3455-1
https://access.redhat.com/errata/RHSA-2017:2907
https://access.redhat.com/security/vulnerabilities/kracks
https://cert.vde.com/en-us/advisories/vde-2017-005
https://cert-portal.siemens.com/productcert/pdf/ssa-901333.pdf
https://github.com/vanhoefm/krackattacks-test-ap-ft
https://ics-cert.us-cert.gov/advisories/ICSA-17-299-02
https://rockwellautomation.custhelp.com/app/answers/detail/a_id/1066697
https://security.FreeBSD.org/advisories/FreeBSD-SA-17:07.wpa.asc
https://security.gentoo.org/glsa/201711-03
https://source.android.com/security/bulletin/2017-11-01
https://support.lenovo.com/us/en/product_security/LEN-17420
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171016-wpa
https://w1.fi/security/2017-1/wpa-packet-number-reuse-with-replayed-messages.txt
https://www.krackattacks.com/

Copyright 2022, cxsecurity.com

 

Back to Top