Key management errors - CVE-2017-13081

Vulnerability identifier: #VU8841

CSH Severity: High

CVSS v4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-13081

CWE-ID: CWE-320

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows an adjacent attacker to force a supplicant to reinstall a previously used integrity group key.

The weakness exists in the processing of the 802.11i 4-way handshake messages of the WPA and WPA2 protocols due to ambiguities in the processing of associated protocol messages. An adjacent attacker can use man-in-the-middle techniques to retransmit previously used message exchanges between supplicant and authenticator.

Debian Linux
Gentoo Linux
Arch Linux
FortiOS
Fedora
ArubaOS (AOS)
HPE Helion Openstack
SUSE OpenStack Cloud
SUSE OpenStack Cloud Crowbar
SUSE Linux
FreeBSD
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
Junos OS
Slackware Linux
Ubuntu
Opensuse
Cisco WAP561
Cisco WAP551
Cisco WAP371
Cisco WAP321
Cisco WAP121
Cisco ASA 5506W-X w
Cisco Spark Room Series
Cisco IP Phone 8865
Cisco IP Phone 8861
Cisco DX80 Series IP Phones
Cisco DX70 Series IP Phones
Stratix 5100
Cisco Meraki
Cisco Wireless IP Phone 8821
Aironet
busybox (Alpine package)
hostapd (Alpine package)
wpa_supplicant (Alpine package)
wpa_supplicant
hostapd
wpa_supplicant-debugsource
wpa_supplicant-debuginfo
ESP-IDF

hostapd (Alpine package) - addressed in versions 2.6-r1, 2.6-r2
wpa_supplicant (Alpine package) - update to 2.6-r2
ESP-IDF - addressed in versions 4.3.5, 5.0.1
wpa_supplicant - addressed in versions 2.6-3.fc25.1, 2.6-11.fc26, 2.6-11.fc27
hostapd - addressed in versions 2.6-6.fc25, 2.6-6.fc26, 2.6-6.fc27, 2.6-7.el6, 2.6-7.el7
wpa_supplicant-debugsource - update to 2.9-15.22.1
wpa_supplicant-debuginfo - update to 2.9-15.22.1
wpa_supplicant - update to 2.9-15.22.1

• https://www.krackattacks.com/
• https://papers.mathyvanhoef.com/ccs2017.pdf

• Multiple Vulnerabilities in Wi-Fi Protected Access and Wi-Fi Protected Access II in Cisco products
• Multiple vulnerabilities in Juniper Junos SRX Series WPA/WPA2 Protocol
• Multiple vulnerabilities in Fortinet FortiOS WPA/WPA2 Protocol
• Multiple vulnerabilities ArubaOS WPA/WPA2 Protocol
• FreeBSD update for WPA2 protocol
• Debian update for wpa
• Ubuntu update for wpa_supplicant and hostapd
• Arch Linux update for hostapd
• [ASA-201710-22] wpa_supplicant: man-in-the-middle
• Slackware Linux update for wpa_supplicant
• Multiple vulnerabilities in Rockwell Automation Stratix 5100
• Gentoo update for hostapd and wpa_supplicant
• SUSE Linux update for kernel-firmware
• Ubuntu update for Linux firmware
• OpenSUSE Linux update for wpa
• SUSE Linux update for wpa
• SUSE Linux update for wpa
• OpenSUSE Linux update for kernel-firmware
• Key management errors in wpa_supplicant (Alpine package)
• Key management errors in hostapd (Alpine package)
• Key management errors in busybox (Alpine package)
• OpenSUSE Linux update for hostapd
• Multiple vulnerabilities in ESP-IDF
• SUSE update for wpa_supplicant
• Multiple vulnerabilities in ESP-IDF
• Fedora 26 update for wpa_supplicant
• Fedora 25 update for wpa_supplicant
• Fedora 27 update for wpa_supplicant
• Fedora EPEL 7 update for hostapd
• Fedora EPEL 6 update for hostapd
• Fedora 26 update for hostapd
• Fedora 25 update for hostapd
• Fedora 27 update for hostapd