Key management errors - CVE-2017-13086

Vulnerability identifier: #VU8845

CSH Severity: High

CVSS v4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-13086

CWE-ID: CWE-320

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows an adjacent attacker to force a supplicant that is compliant with the 802.11z standard to reinstall a previously used TPK key.

The weakness exists in the processing of the 802.11z (Extensions to Direct-Link Setup) TDLS handshake messages due to ambiguities in the processing of associated protocol messages. An adjacent attacker can passively eavesdrop on a TDLS handshake and retransmit previously used message exchanges between supplicant and authenticator.

Stratix 5100
Cisco WAP561
Cisco WAP551
Cisco WAP371
Cisco WAP321
Cisco WAP121
Cisco ASA 5506W-X w
Cisco Spark Room Series
Cisco IP Phone 8865
Cisco IP Phone 8861
Cisco DX80 Series IP Phones
Cisco DX70 Series IP Phones
Cisco Meraki
Cisco Wireless IP Phone 8821
Arch Linux
Debian Linux
Gentoo Linux
Fedora
ArubaOS (AOS)
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server for ARM
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux Server (for IBM Power LE) - 4 Year Extended Update Support
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux for Power, big endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - Extended Update Support
Red Hat Enterprise Linux Server - 4 Year Extended Update Support
HPE Helion Openstack
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
FreeBSD
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
Junos OS
Slackware Linux
Ubuntu
Aironet
busybox (Alpine package)
hostapd (Alpine package)
wpa_supplicant (Alpine package)
wpa_supplicant
supplicant (Red Hat package)
hostapd
wpa_supplicant-debugsource
wpa_supplicant-debuginfo

hostapd (Alpine package) - addressed in versions 2.6-r1, 2.6-r2
wpa_supplicant (Alpine package) - update to 2.6-r2
wpa_supplicant - addressed in versions 2.6-3.fc25.1, 2.6-11.fc26, 2.6-11.fc27
supplicant (Red Hat package) - update to 2.6-5.el7_4.1
hostapd - addressed in versions 2.6-6.fc25, 2.6-6.fc26, 2.6-6.fc27, 2.6-7.el6, 2.6-7.el7
wpa_supplicant-debugsource - update to 2.9-15.22.1
wpa_supplicant-debuginfo - update to 2.9-15.22.1
wpa_supplicant - update to 2.9-15.22.1

• https://www.krackattacks.com/
• https://papers.mathyvanhoef.com/ccs2017.pdf

• Multiple Vulnerabilities in Wi-Fi Protected Access and Wi-Fi Protected Access II in Cisco products
• Multiple vulnerabilities in Juniper Junos SRX Series WPA/WPA2 Protocol
• Multiple vulnerabilities ArubaOS WPA/WPA2 Protocol
• FreeBSD update for WPA2 protocol
• Debian update for wpa
• Ubuntu update for wpa_supplicant and hostapd
• Arch Linux update for hostapd
• [ASA-201710-22] wpa_supplicant: man-in-the-middle
• Slackware Linux update for wpa_supplicant
• Multiple vulnerabilities in Rockwell Automation Stratix 5100
• Gentoo update for hostapd and wpa_supplicant
• Key management errors in wpa_supplicant (Alpine package)
• Key management errors in hostapd (Alpine package)
• Key management errors in busybox (Alpine package)
• SUSE update for wpa_supplicant
• Fedora 26 update for wpa_supplicant
• Fedora 25 update for wpa_supplicant
• Fedora 27 update for wpa_supplicant
• Fedora EPEL 7 update for hostapd
• Fedora EPEL 6 update for hostapd
• Fedora 26 update for hostapd
• Fedora 25 update for hostapd
• Fedora 27 update for hostapd
• Red Hat Enterprise Linux 7 update for wpa_supplicant