CVE-2017-13077 — MEDIUM (6.8)

Vulnerability Description

Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key (TK) during the four-way handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.

CVSS Score

6.8

MEDIUM

CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

ADJACENT_NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

NONE

Affected Products

Vendor	Product	Versions
Canonical	Ubuntu Linux	14.04
Debian	Debian Linux	8.0
Freebsd	Freebsd	All versions
Opensuse	Leap	42.2
Redhat	Enterprise Linux Desktop	7
Redhat	Enterprise Linux Server	7
W1.Fi	Hostapd	0.2.4
W1.Fi	Wpa Supplicant	0.2.4
Suse	Linux Enterprise Desktop	12
Suse	Linux Enterprise Point Of Sale	11
Suse	Linux Enterprise Server	11
Suse	Openstack Cloud	6

Related Weaknesses (CWE)

CWE-330

References

http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-007.txtThird Party Advisory
http://www.debian.org/security/2017/dsa-3999Third Party Advisory
http://www.kb.cert.org/vuls/id/228519Third Party AdvisoryUS Government Resource
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
http://www.securityfocus.com/bid/101274Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1039573Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1039576Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1039577Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1039578Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1039581Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1039585Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1041432
http://www.ubuntu.com/usn/USN-3455-1Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:2907Third Party Advisory

FAQ

What is CVE-2017-13077?

CVE-2017-13077 is a vulnerability with a CVSS score of 6.8 (MEDIUM). Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key (TK) during the four-way handshake, allowing an attacker within radio range to replay, decr...

How severe is CVE-2017-13077?

CVE-2017-13077 has been rated MEDIUM with a CVSS base score of 6.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2017-13077?

Check the references section above for vendor advisories and patch information. Affected products include: Canonical Ubuntu Linux, Debian Debian Linux, Freebsd Freebsd, Opensuse Leap, Redhat Enterprise Linux Desktop.