Key management errors - CVE-2017-13077

Vulnerability identifier: #VU8837

CSH Severity: High

CVSS v4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-13077

CWE-ID: CWE-320

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows an adjacent attacker to force a supplicant to reinstall a previously used pairwise key.

The weakness exists in the processing of the 802.11i 4-way handshake messages of the WPA and WPA2 protocols due to ambiguities in the processing of associated protocol messages. An adjacent attacker can use man-in-the-middle techniques to retransmit previously used message exchanges between supplicant and authenticator.

Debian Linux
Gentoo Linux
Google Android
Arch Linux
FortiOS
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Fedora
ArubaOS (AOS)
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux Server for ARM
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux Server - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux Server (for IBM Power LE) - 4 Year Extended Update Support
Red Hat Enterprise Linux Server - 4 Year Extended Update Support
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux for Power, big endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
HPE Helion Openstack
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
FreeBSD
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
Junos OS
Slackware Linux
Ubuntu
Cisco WAP561
Cisco WAP551
Cisco WAP371
Cisco WAP321
Cisco WAP121
Cisco ASA 5506W-X w
Cisco Spark Room Series
Cisco IP Phone 8865
Cisco IP Phone 8861
Cisco DX80 Series IP Phones
Cisco DX70 Series IP Phones
Stratix 5100
Cisco Meraki
Cisco Wireless IP Phone 8821
Aironet
busybox (Alpine package)
hostapd (Alpine package)
wpa_supplicant (Alpine package)
firefox-esr (Alpine package)
supplicant (Red Hat package)
wpa_supplicant
hostapd
wpa_supplicant-debuginfo
wpa_supplicant-debugsource
ESP-IDF

hostapd (Alpine package) - addressed in versions 2.6-r1, 2.6-r2
wpa_supplicant (Alpine package) - update to 2.6-r2
ESP-IDF - addressed in versions 4.3.5, 5.0.1
supplicant (Red Hat package) - addressed in versions 0.7.3-9.el6_9.2, 2.6-5.el7_4.1
wpa_supplicant - addressed in versions 2.6-3.fc25.1, 2.6-11.fc26, 2.6-11.fc27
hostapd - addressed in versions 2.6-6.fc25, 2.6-6.fc26, 2.6-6.fc27, 2.6-7.el6, 2.6-7.el7
wpa_supplicant - update to 2.9-15.22.1
wpa_supplicant-debuginfo - update to 2.9-15.22.1
wpa_supplicant-debugsource - update to 2.9-15.22.1

• https://www.krackattacks.com/
• https://papers.mathyvanhoef.com/ccs2017.pdf

• Multiple Vulnerabilities in Wi-Fi Protected Access and Wi-Fi Protected Access II in Cisco products
• Multiple vulnerabilities in Juniper Junos SRX Series WPA/WPA2 Protocol
• Multiple vulnerabilities in Fortinet FortiOS WPA/WPA2 Protocol
• Multiple vulnerabilities ArubaOS WPA/WPA2 Protocol
• FreeBSD update for WPA2 protocol
• Debian update for wpa
• Ubuntu update for wpa_supplicant and hostapd
• Arch Linux update for hostapd
• [ASA-201710-22] wpa_supplicant: man-in-the-middle
• Slackware Linux update for wpa_supplicant
• Multiple vulnerabilities in Rockwell Automation Stratix 5100
• Gentoo update for hostapd and wpa_supplicant
• Multiple vulnerabilities in Google Android
• Key management errors in hostapd (Alpine package)
• Key management errors in wpa_supplicant (Alpine package)
• Key management errors in busybox (Alpine package)
• Key management errors in firefox-esr (Alpine package)
• Multiple vulnerabilities in ESP-IDF
• SUSE update for wpa_supplicant
• Multiple vulnerabilities in ESP-IDF
• Fedora 26 update for wpa_supplicant
• Fedora 25 update for wpa_supplicant
• Fedora 27 update for wpa_supplicant
• Fedora EPEL 7 update for hostapd
• Fedora EPEL 6 update for hostapd
• Fedora 26 update for hostapd
• Fedora 25 update for hostapd
• Fedora 27 update for hostapd
• Red Hat Enterprise Linux 7 update for wpa_supplicant
• Red Hat Enterprise Linux 6 update for wpa_supplicant