5.3

CVE-2017-13088

Wi-Fi Protected Access (WPA and WPA2) that support 802.11v allows reinstallation of the Integrity Group Temporal Key (IGTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame, allowing an attacker within radio range to replay frames from access points to clients.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Canonical ≫ Ubuntu Linux Version 14.04 SwEdition lts
Canonical ≫ Ubuntu Linux Version 16.04 SwEdition lts
Canonical ≫ Ubuntu Linux Version 17.04
Debian ≫ Debian Linux Version 8.0
Debian ≫ Debian Linux Version 9.0
Freebsd ≫ Freebsd Version 10
Freebsd ≫ Freebsd Version 10.4
Freebsd ≫ Freebsd Version 11
Freebsd ≫ Freebsd Version 11.1
Opensuse ≫ Leap Version 42.2
Opensuse ≫ Leap Version 42.3
W1.Fi ≫ Hostapd Version 0.2.4
W1.Fi ≫ Hostapd Version 0.2.5
W1.Fi ≫ Hostapd Version 0.2.6
W1.Fi ≫ Hostapd Version 0.2.8
W1.Fi ≫ Hostapd Version 0.3.7
W1.Fi ≫ Hostapd Version 0.3.9
W1.Fi ≫ Hostapd Version 0.3.10
W1.Fi ≫ Hostapd Version 0.3.11
W1.Fi ≫ Hostapd Version 0.4.7
W1.Fi ≫ Hostapd Version 0.4.8
W1.Fi ≫ Hostapd Version 0.4.9
W1.Fi ≫ Hostapd Version 0.4.10
W1.Fi ≫ Hostapd Version 0.4.11
W1.Fi ≫ Hostapd Version 0.5.7
W1.Fi ≫ Hostapd Version 0.5.8
W1.Fi ≫ Hostapd Version 0.5.9
W1.Fi ≫ Hostapd Version 0.5.10
W1.Fi ≫ Hostapd Version 0.5.11
W1.Fi ≫ Hostapd Version 0.6.8
W1.Fi ≫ Hostapd Version 0.6.9
W1.Fi ≫ Hostapd Version 0.6.10
W1.Fi ≫ Hostapd Version 0.7.3
W1.Fi ≫ Hostapd Version 1.0
W1.Fi ≫ Hostapd Version 1.1
W1.Fi ≫ Hostapd Version 2.0
W1.Fi ≫ Hostapd Version 2.1
W1.Fi ≫ Hostapd Version 2.2
W1.Fi ≫ Hostapd Version 2.3
W1.Fi ≫ Hostapd Version 2.4
W1.Fi ≫ Hostapd Version 2.5
W1.Fi ≫ Hostapd Version 2.6
W1.Fi ≫ Wpa Supplicant Version 0.2.4
W1.Fi ≫ Wpa Supplicant Version 0.2.5
W1.Fi ≫ Wpa Supplicant Version 0.2.6
W1.Fi ≫ Wpa Supplicant Version 0.2.7
W1.Fi ≫ Wpa Supplicant Version 0.2.8
W1.Fi ≫ Wpa Supplicant Version 0.3.7
W1.Fi ≫ Wpa Supplicant Version 0.3.8
W1.Fi ≫ Wpa Supplicant Version 0.3.9
W1.Fi ≫ Wpa Supplicant Version 0.3.10
W1.Fi ≫ Wpa Supplicant Version 0.3.11
W1.Fi ≫ Wpa Supplicant Version 0.4.7
W1.Fi ≫ Wpa Supplicant Version 0.4.8
W1.Fi ≫ Wpa Supplicant Version 0.4.9
W1.Fi ≫ Wpa Supplicant Version 0.4.10
W1.Fi ≫ Wpa Supplicant Version 0.4.11
W1.Fi ≫ Wpa Supplicant Version 0.5.7
W1.Fi ≫ Wpa Supplicant Version 0.5.8
W1.Fi ≫ Wpa Supplicant Version 0.5.9
W1.Fi ≫ Wpa Supplicant Version 0.5.10
W1.Fi ≫ Wpa Supplicant Version 0.5.11
W1.Fi ≫ Wpa Supplicant Version 0.6.8
W1.Fi ≫ Wpa Supplicant Version 0.6.9
W1.Fi ≫ Wpa Supplicant Version 0.6.10
W1.Fi ≫ Wpa Supplicant Version 0.7.3
W1.Fi ≫ Wpa Supplicant Version 1.0
W1.Fi ≫ Wpa Supplicant Version 1.1
W1.Fi ≫ Wpa Supplicant Version 2.0
W1.Fi ≫ Wpa Supplicant Version 2.1
W1.Fi ≫ Wpa Supplicant Version 2.2
W1.Fi ≫ Wpa Supplicant Version 2.3
W1.Fi ≫ Wpa Supplicant Version 2.4
W1.Fi ≫ Wpa Supplicant Version 2.5
W1.Fi ≫ Wpa Supplicant Version 2.6
Suse ≫ Linux Enterprise Desktop Version 12 Update sp2
Suse ≫ Linux Enterprise Desktop Version 12 Update sp3
Suse ≫ Linux Enterprise Point Of Sale Version 11 Update sp3
Suse ≫ Linux Enterprise Server Version 11 Update sp3 SwPlatform ltss
Suse ≫ Linux Enterprise Server Version 11 Update sp4
Suse ≫ Linux Enterprise Server Version 12 SwEdition ltss
Suse ≫ Openstack Cloud Version 6
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.81% 0.757
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5.3 1.6 3.6
CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
NIST 2.9 5.5 2.9
AV:A/AC:M/Au:N/C:N/I:P/A:N
CWE-323 Reusing a Nonce, Key Pair in Encryption

Nonces should be used for the present occasion and only once.

CWE-330 Use of Insufficiently Random Values

The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.

http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
http://www.ubuntu.com/usn/USN-3455-1
Third Party Advisory
https://source.android.com/security/bulletin/2017-11-01
http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-007.txt
Third Party Advisory
http://www.debian.org/security/2017/dsa-3999
Third Party Advisory
http://www.kb.cert.org/vuls/id/228519
Third Party Advisory
US Government Resource
http://www.securityfocus.com/bid/101274
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1039573
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1039576
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1039577
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1039578
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1039581
Third Party Advisory
VDB Entry
https://access.redhat.com/errata/RHSA-2017:2907
Third Party Advisory
https://access.redhat.com/security/vulnerabilities/kracks
Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-901333.pdf
https://cert.vde.com/en-us/advisories/vde-2017-005
https://security.FreeBSD.org/advisories/FreeBSD-SA-17:07.wpa.asc
Third Party Advisory
https://security.gentoo.org/glsa/201711-03
https://support.lenovo.com/us/en/product_security/LEN-17420
Third Party Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171016-wpa
Third Party Advisory
https://w1.fi/security/2017-1/wpa-packet-number-reuse-with-replayed-messages.txt
Third Party Advisory
https://www.krackattacks.com/
Third Party Advisory
Technical Description
http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00020.html
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00023.html
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00024.html
Third Party Advisory