CVE-2017-13088 — MEDIUM (5.3)

Vulnerability Description

Wi-Fi Protected Access (WPA and WPA2) that support 802.11v allows reinstallation of the Integrity Group Temporal Key (IGTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame, allowing an attacker within radio range to replay frames from access points to clients.

CVSS Score

5.3

MEDIUM

CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

ADJACENT_NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

HIGH

Availability

NONE

Affected Products

Vendor	Product	Versions
Canonical	Ubuntu Linux	14.04
Debian	Debian Linux	8.0
Freebsd	Freebsd	All versions
Opensuse	Leap	42.2
Redhat	Enterprise Linux Desktop	7
Redhat	Enterprise Linux Server	7
W1.Fi	Hostapd	0.2.4
W1.Fi	Wpa Supplicant	0.2.4
Suse	Linux Enterprise Desktop	12
Suse	Linux Enterprise Point Of Sale	11
Suse	Linux Enterprise Server	11
Suse	Openstack Cloud	6

Related Weaknesses (CWE)

CWE-330 CWE-323

References

http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00020.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00023.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00024.htmlThird Party Advisory
http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-007.txtThird Party Advisory
http://www.debian.org/security/2017/dsa-3999Third Party Advisory
http://www.kb.cert.org/vuls/id/228519Third Party AdvisoryUS Government Resource
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
http://www.securityfocus.com/bid/101274Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1039573Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1039576Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1039577Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1039578Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1039581Third Party AdvisoryVDB Entry
http://www.ubuntu.com/usn/USN-3455-1Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:2907Third Party Advisory

FAQ

What is CVE-2017-13088?

CVE-2017-13088 is a vulnerability with a CVSS score of 5.3 (MEDIUM). Wi-Fi Protected Access (WPA and WPA2) that support 802.11v allows reinstallation of the Integrity Group Temporal Key (IGTK) when processing a Wireless Network Management (WNM) Sleep Mode Response fram...

How severe is CVE-2017-13088?

CVE-2017-13088 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2017-13088?

Check the references section above for vendor advisories and patch information. Affected products include: Canonical Ubuntu Linux, Debian Debian Linux, Freebsd Freebsd, Opensuse Leap, Redhat Enterprise Linux Desktop.