CVE-2017-13086 Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Tunneled Direct-Link Setup (TDLS) Peer Key (TPK) during the TDLS handshake, allowing an attacker within radio range to replay, decryp...
MediumCVSS 6.8
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Tunneled Direct-Link Setup (TDLS) Peer Key (TPK) during the TDLS handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/wpa(Debian:12) | < 2:2.4-1.1 | 2:2.4-1.1 |
| debian/wpa(Debian:13) | < 2:2.4-1.1 | 2:2.4-1.1 |
| debian/wpa(Debian:14) | < 2:2.4-1.1 | 2:2.4-1.1 |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 16.04 | No fix listed |
| Canonical Ubuntu Linux | = 17.04 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| freebsd | All versions | No fix listed |
| freebsd | = 10 | No fix listed |
| freebsd | = 10.4 | No fix listed |
| freebsd | = 11 | No fix listed |
| freebsd | = 11.1 | No fix listed |
| openSUSE leap | = 42.2 | No fix listed |
| openSUSE leap | = 42.3 | No fix listed |
| redhat enterprise linux desktop | = 7 | No fix listed |
| redhat enterprise linux server | = 7 | No fix listed |
| w1.fi hostapd | = 0.2.4 | No fix listed |
| w1.fi hostapd | = 0.2.5 | No fix listed |
| w1.fi hostapd | = 0.2.6 | No fix listed |
| w1.fi hostapd | = 0.2.8 | No fix listed |
| w1.fi hostapd | = 0.3.7 | No fix listed |
| w1.fi hostapd | = 0.3.9 | No fix listed |
| w1.fi hostapd | = 0.3.10 | No fix listed |
| w1.fi hostapd | = 0.3.11 | No fix listed |
Show 105 more
| Product | Affected versions | Fixed in |
|---|---|---|
| w1.fi hostapd | = 0.4.7 | No fix listed |
| w1.fi hostapd | = 0.4.8 | No fix listed |
| w1.fi hostapd | = 0.4.9 | No fix listed |
| w1.fi hostapd | = 0.4.10 | No fix listed |
| w1.fi hostapd | = 0.4.11 | No fix listed |
| w1.fi hostapd | = 0.5.7 | No fix listed |
| w1.fi hostapd | = 0.5.8 | No fix listed |
| w1.fi hostapd | = 0.5.9 | No fix listed |
| w1.fi hostapd | = 0.5.10 | No fix listed |
| w1.fi hostapd | = 0.5.11 | No fix listed |
| w1.fi hostapd | = 0.6.8 | No fix listed |
| w1.fi hostapd | = 0.6.9 | No fix listed |
| w1.fi hostapd | = 0.6.10 | No fix listed |
| w1.fi hostapd | = 0.7.3 | No fix listed |
| w1.fi hostapd | = 1.0 | No fix listed |
| w1.fi hostapd | = 1.1 | No fix listed |
| w1.fi hostapd | = 2.0 | No fix listed |
| w1.fi hostapd | = 2.1 | No fix listed |
| w1.fi hostapd | = 2.2 | No fix listed |
| w1.fi hostapd | = 2.3 | No fix listed |
| w1.fi hostapd | = 2.4 | No fix listed |
| w1.fi hostapd | = 2.5 | No fix listed |
| w1.fi hostapd | = 2.6 | No fix listed |
| w1.fi wpa supplicant | = 0.2.4 | No fix listed |
| w1.fi wpa supplicant | = 0.2.5 | No fix listed |
| w1.fi wpa supplicant | = 0.2.6 | No fix listed |
| w1.fi wpa supplicant | = 0.2.7 | No fix listed |
| w1.fi wpa supplicant | = 0.2.8 | No fix listed |
| w1.fi wpa supplicant | = 0.3.7 | No fix listed |
| w1.fi wpa supplicant | = 0.3.8 | No fix listed |
| w1.fi wpa supplicant | = 0.3.9 | No fix listed |
| w1.fi wpa supplicant | = 0.3.10 | No fix listed |
| w1.fi wpa supplicant | = 0.3.11 | No fix listed |
| w1.fi wpa supplicant | = 0.4.7 | No fix listed |
| w1.fi wpa supplicant | = 0.4.8 | No fix listed |
| w1.fi wpa supplicant | = 0.4.9 | No fix listed |
| w1.fi wpa supplicant | = 0.4.10 | No fix listed |
| w1.fi wpa supplicant | = 0.4.11 | No fix listed |
| w1.fi wpa supplicant | = 0.5.7 | No fix listed |
| w1.fi wpa supplicant | = 0.5.8 | No fix listed |
| w1.fi wpa supplicant | = 0.5.9 | No fix listed |
| w1.fi wpa supplicant | = 0.5.10 | No fix listed |
| w1.fi wpa supplicant | = 0.5.11 | No fix listed |
| w1.fi wpa supplicant | = 0.6.8 | No fix listed |
| w1.fi wpa supplicant | = 0.6.9 | No fix listed |
| w1.fi wpa supplicant | = 0.6.10 | No fix listed |
| w1.fi wpa supplicant | = 0.7.3 | No fix listed |
| w1.fi wpa supplicant | = 1.0 | No fix listed |
| w1.fi wpa supplicant | = 1.1 | No fix listed |
| w1.fi wpa supplicant | = 2.0 | No fix listed |
| w1.fi wpa supplicant | = 2.1 | No fix listed |
| w1.fi wpa supplicant | = 2.2 | No fix listed |
| w1.fi wpa supplicant | = 2.3 | No fix listed |
| w1.fi wpa supplicant | = 2.4 | No fix listed |
| w1.fi wpa supplicant | = 2.5 | No fix listed |
| w1.fi wpa supplicant | = 2.6 | No fix listed |
| SUSE linux enterprise desktop | = 12-sp2 | No fix listed |
| SUSE linux enterprise desktop | = 12-sp3 | No fix listed |
| SUSE linux enterprise point of sale | = 11-sp3 | No fix listed |
| SUSE linux enterprise server | = 11-sp3 | No fix listed |
| SUSE linux enterprise server | = 11-sp4 | No fix listed |
| SUSE linux enterprise server | = 12 | No fix listed |
| SUSE openstack cloud | = 6 | No fix listed |
| alpine/hostapd(Alpine:v3.10) | < 2.6-r2 | 2.6-r2 |
| alpine/hostapd(Alpine:v3.11) | < 2.6-r2 | 2.6-r2 |
| alpine/hostapd(Alpine:v3.12) | < 2.6-r2 | 2.6-r2 |
| alpine/hostapd(Alpine:v3.13) | < 2.6-r2 | 2.6-r2 |
| alpine/hostapd(Alpine:v3.14) | < 2.6-r2 | 2.6-r2 |
| alpine/hostapd(Alpine:v3.15) | < 2.6-r2 | 2.6-r2 |
| alpine/hostapd(Alpine:v3.16) | < 2.6-r2 | 2.6-r2 |
| alpine/hostapd(Alpine:v3.17) | < 2.6-r2 | 2.6-r2 |
| alpine/hostapd(Alpine:v3.18) | < 2.6-r2 | 2.6-r2 |
| alpine/hostapd(Alpine:v3.19) | < 2.6-r2 | 2.6-r2 |
| alpine/hostapd(Alpine:v3.20) | < 2.6-r2 | 2.6-r2 |
| alpine/hostapd(Alpine:v3.21) | < 2.6-r2 | 2.6-r2 |
| alpine/hostapd(Alpine:v3.22) | < 2.6-r2 | 2.6-r2 |
| alpine/hostapd(Alpine:v3.23) | < 2.6-r2 | 2.6-r2 |
| alpine/hostapd(Alpine:v3.24) | < 2.6-r2 | 2.6-r2 |
| alpine/hostapd(Alpine:v3.5) | < 2.6-r1 | 2.6-r1 |
| alpine/hostapd(Alpine:v3.6) | < 2.6-r2 | 2.6-r2 |
| alpine/hostapd(Alpine:v3.7) | < 2.6-r2 | 2.6-r2 |
| alpine/hostapd(Alpine:v3.8) | < 2.6-r2 | 2.6-r2 |
| alpine/hostapd(Alpine:v3.9) | < 2.6-r2 | 2.6-r2 |
| alpine/wpa_supplicant(Alpine:v3.10) | < 2.6-r7 | 2.6-r7 |
| alpine/wpa_supplicant(Alpine:v3.11) | < 2.6-r7 | 2.6-r7 |
| alpine/wpa_supplicant(Alpine:v3.12) | < 2.6-r7 | 2.6-r7 |
| alpine/wpa_supplicant(Alpine:v3.13) | < 2.6-r7 | 2.6-r7 |
| alpine/wpa_supplicant(Alpine:v3.14) | < 2.6-r7 | 2.6-r7 |
| alpine/wpa_supplicant(Alpine:v3.15) | < 2.6-r7 | 2.6-r7 |
| alpine/wpa_supplicant(Alpine:v3.16) | < 2.6-r7 | 2.6-r7 |
| alpine/wpa_supplicant(Alpine:v3.17) | < 2.6-r7 | 2.6-r7 |
| alpine/wpa_supplicant(Alpine:v3.18) | < 2.6-r7 | 2.6-r7 |
| alpine/wpa_supplicant(Alpine:v3.19) | < 2.6-r7 | 2.6-r7 |
| alpine/wpa_supplicant(Alpine:v3.20) | < 2.6-r7 | 2.6-r7 |
| alpine/wpa_supplicant(Alpine:v3.21) | < 2.6-r7 | 2.6-r7 |
| alpine/wpa_supplicant(Alpine:v3.22) | < 2.6-r7 | 2.6-r7 |
| alpine/wpa_supplicant(Alpine:v3.23) | < 2.6-r7 | 2.6-r7 |
| alpine/wpa_supplicant(Alpine:v3.24) | < 2.6-r7 | 2.6-r7 |
| alpine/wpa_supplicant(Alpine:v3.5) | < 2.6-r2 | 2.6-r2 |
| alpine/wpa_supplicant(Alpine:v3.6) | < 2.6-r4 | 2.6-r4 |
| alpine/wpa_supplicant(Alpine:v3.7) | < 2.6-r7 | 2.6-r7 |
| alpine/wpa_supplicant(Alpine:v3.8) | < 2.6-r7 | 2.6-r7 |
| alpine/wpa_supplicant(Alpine:v3.9) | < 2.6-r7 | 2.6-r7 |
| Wi-Fi Alliance Wi-Fi Protected Access (WPA and WPA2) | = WPA | No fix listed |
| Wi-Fi Alliance Wi-Fi Protected Access (WPA and WPA2) | = WPA2 | No fix listed |
References
- Debian Security Tracker CVE-2017-13086 vendor-advisory
- www.arubanetworks.com third-party-advisory
- DSA-3999 third-party-advisory vendor-advisory
- VU#228519 third-party-advisory us-government-resource
- 101274 third-party-advisory vdb-entry
- 1039573 third-party-advisory vdb-entry
- 1039576 third-party-advisory vdb-entry
- 1039577 third-party-advisory vdb-entry
- 1039578 third-party-advisory vdb-entry
- 1039581 third-party-advisory vdb-entry
- USN-3455-1 third-party-advisory vendor-advisory
- RHSA-2017:2907 third-party-advisory vendor-advisory
- access.redhat.com third-party-advisory
- cert-portal.siemens.com
- cert.vde.com
- FreeBSD-SA-17:07 third-party-advisory vendor-advisory
- GLSA-201711-03 vendor-advisory
- source.android.com
- support.lenovo.com third-party-advisory
- 20171016 Multiple Vulnerabilities in Wi-Fi Protected Access and Wi-Fi Protected Access II third-party-advisory vendor-advisory
- w1.fi third-party-advisory
- www.krackattacks.com technical-description third-party-advisory
- security.alpinelinux.org vendor-advisory