CVE-2017-13078 — MEDIUM (5.3)

Vulnerability Description

Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the four-way handshake, allowing an attacker within radio range to replay frames from access points to clients.

CVSS Score

5.3

MEDIUM

CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

ADJACENT_NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

HIGH

Availability

NONE

Affected Products

Vendor	Product	Versions
Canonical	Ubuntu Linux	14.04
Debian	Debian Linux	8.0
Freebsd	Freebsd	All versions
Opensuse	Leap	42.2
Redhat	Enterprise Linux Desktop	7
Redhat	Enterprise Linux Server	7
W1.Fi	Hostapd	0.2.4
W1.Fi	Wpa Supplicant	0.2.4
Suse	Linux Enterprise Desktop	12
Suse	Linux Enterprise Point Of Sale	11
Suse	Linux Enterprise Server	11
Suse	Openstack Cloud	6

Related Weaknesses (CWE)

CWE-330 CWE-323

References

http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00020.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00023.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00024.htmlThird Party Advisory
http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-007.txtThird Party Advisory
http://www.debian.org/security/2017/dsa-3999Third Party Advisory
http://www.kb.cert.org/vuls/id/228519Third Party AdvisoryUS Government Resource
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
http://www.securityfocus.com/bid/101274Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1039573Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1039576Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1039577Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1039578Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1039581Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1039585Third Party AdvisoryVDB Entry

FAQ

What is CVE-2017-13078?

CVE-2017-13078 is a vulnerability with a CVSS score of 5.3 (MEDIUM). Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the four-way handshake, allowing an attacker within radio range to replay frames from access points t...

How severe is CVE-2017-13078?

CVE-2017-13078 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2017-13078?

Check the references section above for vendor advisories and patch information. Affected products include: Canonical Ubuntu Linux, Debian Debian Linux, Freebsd Freebsd, Opensuse Leap, Redhat Enterprise Linux Desktop.