Vulnerability Description
Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Tunneled Direct-Link Setup (TDLS) Peer Key (TPK) during the TDLS handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Canonical | Ubuntu Linux | 14.04 |
| Debian | Debian Linux | 8.0 |
| Freebsd | Freebsd | All versions |
| Opensuse | Leap | 42.2 |
| Redhat | Enterprise Linux Desktop | 7 |
| Redhat | Enterprise Linux Server | 7 |
| W1.Fi | Hostapd | 0.2.4 |
| W1.Fi | Wpa Supplicant | 0.2.4 |
| Suse | Linux Enterprise Desktop | 12 |
| Suse | Linux Enterprise Point Of Sale | 11 |
| Suse | Linux Enterprise Server | 11 |
| Suse | Openstack Cloud | 6 |
Related Weaknesses (CWE)
References
- http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-007.txtThird Party Advisory
- http://www.debian.org/security/2017/dsa-3999Third Party Advisory
- http://www.kb.cert.org/vuls/id/228519Third Party AdvisoryUS Government Resource
- http://www.securityfocus.com/bid/101274Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1039573Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1039576Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1039577Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1039578Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1039581Third Party AdvisoryVDB Entry
- http://www.ubuntu.com/usn/USN-3455-1Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:2907Third Party Advisory
- https://access.redhat.com/security/vulnerabilities/kracksThird Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-901333.pdf
- https://cert.vde.com/en-us/advisories/vde-2017-005
- https://security.FreeBSD.org/advisories/FreeBSD-SA-17:07.wpa.ascThird Party Advisory
FAQ
What is CVE-2017-13086?
CVE-2017-13086 is a vulnerability with a CVSS score of 6.8 (MEDIUM). Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Tunneled Direct-Link Setup (TDLS) Peer Key (TPK) during the TDLS handshake, allowing an attacker within radio range to replay, decryp...
How severe is CVE-2017-13086?
CVE-2017-13086 has been rated MEDIUM with a CVSS base score of 6.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2017-13086?
Check the references section above for vendor advisories and patch information. Affected products include: Canonical Ubuntu Linux, Debian Debian Linux, Freebsd Freebsd, Opensuse Leap, Redhat Enterprise Linux Desktop.