ID de Prueba:	1.3.6.1.4.1.25623.1.1.13.2017.291.02
Categoría:	Slackware Local Security Checks
Título:	Slackware: Security Advisory (SSA:2017-291-02)
Resumen:	The remote host is missing an update for the 'wpa_supplicant' package(s) announced via the SSA:2017-291-02 advisory.
Descripción:	Summary: The remote host is missing an update for the 'wpa_supplicant' package(s) announced via the SSA:2017-291-02 advisory. Vulnerability Insight: New wpa_supplicant packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: +--------------------------+ patches/packages/wpa_supplicant-2.6-i586-1_slack14.2.txz: Upgraded. This update includes patches to mitigate the WPA2 protocol issues known as 'KRACK' (Key Reinstallation AttaCK), which may be used to decrypt data, hijack TCP connections, and to forge and inject packets. This is the list of vulnerabilities that are addressed here: CVE-2017-13077: Reinstallation of the pairwise encryption key (PTK-TK) in the 4-way handshake. CVE-2017-13078: Reinstallation of the group key (GTK) in the 4-way handshake. CVE-2017-13079: Reinstallation of the integrity group key (IGTK) in the 4-way handshake. CVE-2017-13080: Reinstallation of the group key (GTK) in the group key handshake. CVE-2017-13081: Reinstallation of the integrity group key (IGTK) in the group key handshake. CVE-2017-13082: Accepting a retransmitted Fast BSS Transition (FT) Reassociation Request and reinstalling the pairwise encryption key (PTK-TK) while processing it. CVE-2017-13084: Reinstallation of the STK key in the PeerKey handshake. CVE-2017-13086: reinstallation of the Tunneled Direct-Link Setup (TDLS) PeerKey (TPK) key in the TDLS handshake. CVE-2017-13087: reinstallation of the group key (GTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame. CVE-2017-13088: reinstallation of the integrity group key (IGTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame. For more information, see: [links moved to references] (* Security fix *) +--------------------------+ Affected Software/OS: 'wpa_supplicant' package(s) on Slackware 14.0, Slackware 14.1, Slackware 14.2, Slackware current. Solution: Please install the updated package(s). CVSS Score: 5.8 CVSS Vector: AV:A/AC:L/Au:N/C:P/I:P/A:P
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2017-13077 BugTraq ID: 101274 http://www.securityfocus.com/bid/101274 CERT/CC vulnerability note: VU#228519 http://www.kb.cert.org/vuls/id/228519 Cisco Security Advisory: 20171016 Multiple Vulnerabilities in Wi-Fi Protected Access and Wi-Fi Protected Access II https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171016-wpa Debian Security Information: DSA-3999 (Google Search) http://www.debian.org/security/2017/dsa-3999 FreeBSD Security Advisory: FreeBSD-SA-17:07 https://security.FreeBSD.org/advisories/FreeBSD-SA-17:07.wpa.asc https://security.gentoo.org/glsa/201711-03 https://w1.fi/security/2017-1/wpa-packet-number-reuse-with-replayed-messages.txt https://www.krackattacks.com/ https://lists.debian.org/debian-lts-announce/2018/11/msg00015.html RedHat Security Advisories: RHSA-2017:2907 https://access.redhat.com/errata/RHSA-2017:2907 RedHat Security Advisories: RHSA-2017:2911 https://access.redhat.com/errata/RHSA-2017:2911 http://www.securitytracker.com/id/1039573 http://www.securitytracker.com/id/1039576 http://www.securitytracker.com/id/1039577 http://www.securitytracker.com/id/1039578 http://www.securitytracker.com/id/1039581 http://www.securitytracker.com/id/1039585 http://www.securitytracker.com/id/1041432 http://www.ubuntu.com/usn/USN-3455-1 Common Vulnerability Exposure (CVE) ID: CVE-2017-13078 SuSE Security Announcement: SUSE-SU-2017:2745 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00020.html SuSE Security Announcement: SUSE-SU-2017:2752 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00023.html SuSE Security Announcement: openSUSE-SU-2017:2755 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00024.html Common Vulnerability Exposure (CVE) ID: CVE-2017-13079 Common Vulnerability Exposure (CVE) ID: CVE-2017-13080 https://lists.debian.org/debian-lts-announce/2017/12/msg00004.html http://www.securitytracker.com/id/1039572 http://www.securitytracker.com/id/1039703 Common Vulnerability Exposure (CVE) ID: CVE-2017-13081 Common Vulnerability Exposure (CVE) ID: CVE-2017-13082 https://github.com/vanhoefm/krackattacks-test-ap-ft https://ics-cert.us-cert.gov/advisories/ICSA-17-299-02 http://www.securitytracker.com/id/1039570 http://www.securitytracker.com/id/1039571 SuSE Security Announcement: openSUSE-SU-2020:0222 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00021.html Common Vulnerability Exposure (CVE) ID: CVE-2017-13084 Common Vulnerability Exposure (CVE) ID: CVE-2017-13086 Common Vulnerability Exposure (CVE) ID: CVE-2017-13087 Common Vulnerability Exposure (CVE) ID: CVE-2017-13088
Copyright	Copyright (C) 2022 Greenbone AG

Esta es sólo una de 145615 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.