Use of Insufficiently Random Values Affecting firmware-nonfree package, versions <20180825-1
Threat Intelligence
EPSS
0.42% (75th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-DEBIANUNSTABLE-FIRMWARENONFREE-268117
- published 17 Oct 2017
- disclosed 17 Oct 2017
Introduced: 17 Oct 2017
CVE-2017-13080 Open this link in a new tabHow to fix?
Upgrade Debian:unstable firmware-nonfree to version 20180825-1 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream firmware-nonfree package and not the firmware-nonfree package as distributed by Debian.
See How to fix? for Debian:unstable relevant fixed versions and status.
Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the group key handshake, allowing an attacker within radio range to replay frames from access points to clients.
References
- https://security-tracker.debian.org/tracker/CVE-2017-13080
- https://support.apple.com/HT208219
- https://support.apple.com/HT208220
- https://support.apple.com/HT208221
- https://support.apple.com/HT208222
- https://support.apple.com/HT208325
- https://support.apple.com/HT208327
- https://support.apple.com/HT208334
- http://www.kb.cert.org/vuls/id/228519
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171016-wpa
- https://access.redhat.com/security/vulnerabilities/kracks
- https://cert-portal.siemens.com/productcert/pdf/ssa-901333.pdf
- https://cert.vde.com/en-us/advisories/vde-2017-003
- https://cert.vde.com/en-us/advisories/vde-2017-005
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-13080
- https://source.android.com/security/bulletin/2017-11-01
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03792en_us
- https://support.lenovo.com/us/en/product_security/LEN-17420
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00402.html
- http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-007.txt
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13080
- http://www.debian.org/security/2017/dsa-3999
- https://lists.debian.org/debian-lts-announce/2017/12/msg00004.html
- https://lists.debian.org/debian-lts-announce/2018/11/msg00015.html
- https://security.FreeBSD.org/advisories/FreeBSD-SA-17:07.wpa.asc
- https://security.gentoo.org/glsa/201711-03
- https://w1.fi/security/2017-1/wpa-packet-number-reuse-with-replayed-messages.txt
- https://www.krackattacks.com/
- http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00020.html
- http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00023.html
- http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00024.html
- http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
- http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
- https://access.redhat.com/errata/RHSA-2017:2907
- https://access.redhat.com/errata/RHSA-2017:2911
- http://www.securityfocus.com/bid/101274
- http://www.securitytracker.com/id/1039572
- http://www.securitytracker.com/id/1039573
- http://www.securitytracker.com/id/1039576
- http://www.securitytracker.com/id/1039577
- http://www.securitytracker.com/id/1039578
- http://www.securitytracker.com/id/1039581
- http://www.securitytracker.com/id/1039585
- http://www.securitytracker.com/id/1039703
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2017-13080
- http://www.ubuntu.com/usn/USN-3455-1