VulnerabilityModified
CVE-2017-13081
Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11w allows reinstallation of the Integrity Group Temporal Key (IGTK) during the group key handshake, allowing an attacker within radio range to spoof frames from access points to clients.
MEDIUM 5.3EPSS 2.00%
Does this matter?
Lower severity and a low EPSS score (2.00%). Track it; it rarely justifies an emergency change on its own.
Description
Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11w allows reinstallation of the Integrity Group Temporal Key (IGTK) during the group key handshake, allowing an attacker within radio range to spoof frames from access points to clients.
- CVSS 3.0
- 5.3 MEDIUMCVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
- EPSS
- 2.00% probability · 80th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-323, CWE-330
- Affected
- canonical/ubuntu linux · debian/debian linux · freebsd/freebsd · opensuse/leap · redhat/enterprise linux desktop · redhat/enterprise linux server · w1.fi/hostapd · w1.fi/wpa supplicant · suse/linux enterprise desktop · suse/linux enterprise point of sale · suse/linux enterprise server · suse/openstack cloud
- Source
- cret@cert.org
References
- http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00020.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00023.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00024.htmlThird Party Advisory
- http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-007.txtThird Party Advisory
- http://www.debian.org/security/2017/dsa-3999Third Party Advisory
- http://www.kb.cert.org/vuls/id/228519Third Party Advisory, US Government Resource
- http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
- http://www.securityfocus.com/bid/101274Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1039573Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1039576Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1039577Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1039578Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1039581Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1039585Third Party Advisory, VDB Entry
- http://www.ubuntu.com/usn/USN-3455-1Third Party Advisory
- https://access.redhat.com/security/vulnerabilities/kracksThird Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-901333.pdf
- https://cert.vde.com/en-us/advisories/vde-2017-005
- https://lists.debian.org/debian-lts-announce/2018/11/msg00015.html
- https://security.FreeBSD.org/advisories/FreeBSD-SA-17:07.wpa.ascThird Party Advisory
- https://security.gentoo.org/glsa/201711-03
- https://source.android.com/security/bulletin/2017-11-01
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03792en_us
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171016-wpaThird Party Advisory
- https://w1.fi/security/2017-1/wpa-packet-number-reuse-with-replayed-messages.txtThird Party Advisory
- https://www.krackattacks.com/Technical Description, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00020.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00023.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00024.htmlThird Party Advisory
- http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-007.txtThird Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.