Test ID:	1.3.6.1.4.1.25623.1.0.140433
Category:	CISCO
Title:	Cisco Aironet Access Points Multiple WPA2 Vulnerabilities
Summary:	Cisco Aironet Access Points are prone to key reinstallation attacks against;WPA protocol.
Description:	Summary: Cisco Aironet Access Points are prone to key reinstallation attacks against WPA protocol. Vulnerability Insight: On October 16th, 2017, a research paper with the title of 'Key Reinstallation Attacks: Forcing Nonce Reuse in WPA2' was made publicly available. This paper discusses seven vulnerabilities affecting session key negotiation in both the Wi-Fi Protected Access (WPA) and the Wi-Fi Protected Access II (WPA2) protocols. These vulnerabilities may allow the reinstallation of a pairwise transient key, a group key, or an integrity key on either a wireless client or a wireless access point. Additional research also led to the discovery of three additional vulnerabilities (not discussed in the original paper) affecting wireless supplicant supporting either the 802.11z (Extensions to Direct-Link Setup) standard or the 802.11v (Wireless Network Management) standard. The three additional vulnerabilities could also allow the reinstallation of a pairwise key, group key, or integrity group key. Vulnerability Impact: An attacker within the wireless communications range of an affected AP and client may leverage packet decryption and injection, TCP connection hijacking, HTTP content injection, or the replay of unicast, broadcast, and multicast frames. Solution: See the referenced advisory for a solution. CVSS Score: 5.8 CVSS Vector: AV:A/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2017-13082 BugTraq ID: 101274 http://www.securityfocus.com/bid/101274 CERT/CC vulnerability note: VU#228519 http://www.kb.cert.org/vuls/id/228519 Cisco Security Advisory: 20171016 Multiple Vulnerabilities in Wi-Fi Protected Access and Wi-Fi Protected Access II https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171016-wpa Debian Security Information: DSA-3999 (Google Search) http://www.debian.org/security/2017/dsa-3999 FreeBSD Security Advisory: FreeBSD-SA-17:07 https://security.FreeBSD.org/advisories/FreeBSD-SA-17:07.wpa.asc https://security.gentoo.org/glsa/201711-03 https://github.com/vanhoefm/krackattacks-test-ap-ft https://ics-cert.us-cert.gov/advisories/ICSA-17-299-02 https://w1.fi/security/2017-1/wpa-packet-number-reuse-with-replayed-messages.txt https://www.krackattacks.com/ RedHat Security Advisories: RHSA-2017:2907 https://access.redhat.com/errata/RHSA-2017:2907 http://www.securitytracker.com/id/1039570 http://www.securitytracker.com/id/1039571 http://www.securitytracker.com/id/1039573 http://www.securitytracker.com/id/1039581 SuSE Security Announcement: openSUSE-SU-2020:0222 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00021.html http://www.ubuntu.com/usn/USN-3455-1
Copyright	Copyright (C) 2017 Greenbone Networks GmbH

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.