CVE-2017-13081
Wi-Fi Alliance Wi-Fi Protected Access (WPA and WPA2)
MEDIUM 5.3
En bref
- Source
- NVD
- EPSS
- EPSS 1.98 % · centile 80 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- certcc
- Statut NVD
- Modified
Description
Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11w allows reinstallation of the Integrity Group Temporal Key (IGTK) during the group key handshake, allowing an attacker within radio range to spoof frames from access points to clients.
Faiblesses (CWE)
- CWE-323 — Reusing a Nonce, Key Pair in Encryption
- CWE-330 — Utilisation de valeurs insuffisamment aléatoires
Références
- http://www.securitytracker.com/id/1039581
- http://www.securityfocus.com/bid/101274
- http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
- http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00020.html
- http://www.debian.org/security/2017/dsa-3999
- http://www.securitytracker.com/id/1039578
- https://access.redhat.com/security/vulnerabilities/kracks
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171016-wpa
- https://w1.fi/security/2017-1/wpa-packet-number-reuse-with-replayed-messages.txt
- http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-007.txt
- http://www.securitytracker.com/id/1039577
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03792en_us
- http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00024.html
- https://source.android.com/security/bulletin/2017-11-01
- https://security.gentoo.org/glsa/201711-03
- https://security.FreeBSD.org/advisories/FreeBSD-SA-17:07.wpa.asc
- https://www.krackattacks.com/
- http://www.securitytracker.com/id/1039573
- http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00023.html
- http://www.securitytracker.com/id/1039576
- http://www.securitytracker.com/id/1039585
- http://www.kb.cert.org/vuls/id/228519
- https://lists.debian.org/debian-lts-announce/2018/11/msg00015.html
- https://cert-portal.siemens.com/productcert/pdf/ssa-901333.pdf
- https://cert.vde.com/en-us/advisories/vde-2017-005
- http://www.ubuntu.com/usn/USN-3455-1
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.0 | MEDIUM 5.3 | CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | LOW 2.9 | AV:A/AC:M/Au:N/C:N/I:P/A:N | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2017-4599
- GCVE · GCVE-0-2017-13081
Avis du CERT-FR
- CERTFR-2017-AVI-478 — Multiples vulnérabilités dans SCADA les produits Siemens · cert.ssi.gouv.fr
- CERTFR-2017-AVI-398 — Multiples vulnérabilités dans NVIDIA Shield Tablet · cert.ssi.gouv.fr
- CERTFR-2017-AVI-394 — Multiples vulnérabilités dans Google Android (Nexus) · cert.ssi.gouv.fr
- CERTFR-2017-AVI-363 — Multiples vulnérabilités dans SUSE wpa_supplicant · cert.ssi.gouv.fr
- CERTFR-2017-AVI-361 — Multiples vulnérabilités dans les produits Juniper utilisant le protocole WPA/WPA2 · cert.ssi.gouv.fr
- CERTFR-2017-AVI-360 — Multiples vulnérabilités dans les produits Fortinet utilisant le protocole WPA/WPA2 · cert.ssi.gouv.fr
- CERTFR-2017-AVI-359 — Multiples vulnérabilités dans Ubuntu wpa_supplicant et hostpad · cert.ssi.gouv.fr
- CERTFR-2017-AVI-358 — Multiples vulnérabilités dans Debian sur le protocole WPA/WPA2 · cert.ssi.gouv.fr
- CERTFR-2017-ALE-014 — Vulnérabilité dans le protocole WPA/WPA2 · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*cpe:2.3:o:canonical:ubuntu_linux:17.04:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:10:*:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:10.4:*:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:11:*:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:11.1:*:*:*:*:*:*:*cpe:2.3:o:opensuse:leap:42.2:*:*:*:*:*:*:*cpe:2.3:o:opensuse:leap:42.3:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_desktop:7:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server:7:*:*:*:*:*:*:*cpe:2.3:a:w1.fi:hostapd:0.2.4:*:*:*:*:*:*:*cpe:2.3:a:w1.fi:hostapd:0.2.5:*:*:*:*:*:*:*cpe:2.3:a:w1.fi:hostapd:0.2.6:*:*:*:*:*:*:*cpe:2.3:a:w1.fi:hostapd:0.2.8:*:*:*:*:*:*:*cpe:2.3:a:w1.fi:hostapd:0.3.7:*:*:*:*:*:*:*cpe:2.3:a:w1.fi:hostapd:0.3.9:*:*:*:*:*:*:*cpe:2.3:a:w1.fi:hostapd:0.3.10:*:*:*:*:*:*:*cpe:2.3:a:w1.fi:hostapd:0.3.11:*:*:*:*:*:*:*cpe:2.3:a:w1.fi:hostapd:0.4.7:*:*:*:*:*:*:*cpe:2.3:a:w1.fi:hostapd:0.4.8:*:*:*:*:*:*:*cpe:2.3:a:w1.fi:hostapd:0.4.9:*:*:*:*:*:*:*cpe:2.3:a:w1.fi:hostapd:0.4.10:*:*:*:*:*:*:*cpe:2.3:a:w1.fi:hostapd:0.4.11:*:*:*:*:*:*:*cpe:2.3:a:w1.fi:hostapd:0.5.7:*:*:*:*:*:*:*cpe:2.3:a:w1.fi:hostapd:0.5.8:*:*:*:*:*:*:*cpe:2.3:a:w1.fi:hostapd:0.5.9:*:*:*:*:*:*:*cpe:2.3:a:w1.fi:hostapd:0.5.10:*:*:*:*:*:*:*cpe:2.3:a:w1.fi:hostapd:0.5.11:*:*:*:*:*:*:*cpe:2.3:a:w1.fi:hostapd:0.6.8:*:*:*:*:*:*:*cpe:2.3:a:w1.fi:hostapd:0.6.9:*:*:*:*:*:*:*cpe:2.3:a:w1.fi:hostapd:0.6.10:*:*:*:*:*:*:*cpe:2.3:a:w1.fi:hostapd:0.7.3:*:*:*:*:*:*:*cpe:2.3:a:w1.fi:hostapd:1.0:*:*:*:*:*:*:*cpe:2.3:a:w1.fi:hostapd:1.1:*:*:*:*:*:*:*cpe:2.3:a:w1.fi:hostapd:2.0:*:*:*:*:*:*:*cpe:2.3:a:w1.fi:hostapd:2.1:*:*:*:*:*:*:*- +45 autres
Produits affectés
| Produit | Versions |
|---|---|
| Wi-Fi Alliance · Wi-Fi Protected Access (WPA and WPA2) | affected WPA ; affected WPA2 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |