Security update for wpa_supplicant SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2017:2752-1 Final 1 1 2017-10-17T15:04:39Z current 2017-10-17T15:04:39Z 2017-10-17T15:04:39Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for wpa_supplicant This update for wpa_supplicant fixes the following issues: - Several vulnerabilities in standard conforming implementations of the WPA2 protocol have been discovered and published under the code name KRACK. This update remedies those issues in a backwards compatible manner, i.e. the updated wpa_supplicant can interface properly with both vulnerable and patched implementations of WPA2, but an attacker won't be able to exploit the KRACK weaknesses in those connections anymore even if the other party is still vulnerable. [bsc#1056061, CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13087, CVE-2017-13088] The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sleposp3-wpa_supplicant-13318,slessp3-wpa_supplicant-13318,slessp4-wpa_supplicant-13318 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2017/suse-su-20172752-1/ Link for SUSE-SU-2017:2752-1 https://lists.opensuse.org/opensuse-security-announce/2017-10/msg00023.html E-Mail link for SUSE-SU-2017:2752-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1056061 SUSE Bug 1056061 https://www.suse.com/security/cve/CVE-2017-13078/ SUSE CVE CVE-2017-13078 page https://www.suse.com/security/cve/CVE-2017-13079/ SUSE CVE CVE-2017-13079 page https://www.suse.com/security/cve/CVE-2017-13080/ SUSE CVE CVE-2017-13080 page https://www.suse.com/security/cve/CVE-2017-13081/ SUSE CVE CVE-2017-13081 page https://www.suse.com/security/cve/CVE-2017-13087/ SUSE CVE CVE-2017-13087 page https://www.suse.com/security/cve/CVE-2017-13088/ SUSE CVE CVE-2017-13088 page SUSE Linux Enterprise Point of Sale 11 SP3 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA SUSE Linux Enterprise Server 11 SP4 SUSE Linux Enterprise Server for SAP Applications 11 SP4 wpa_supplicant-0.7.1-6.18.3.1 wpa_supplicant-0.7.1-6.18.3.1 as a component of SUSE Linux Enterprise Point of Sale 11 SP3 wpa_supplicant-0.7.1-6.18.3.1 as a component of SUSE Linux Enterprise Server 11 SP3-LTSS wpa_supplicant-0.7.1-6.18.3.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA wpa_supplicant-0.7.1-6.18.3.1 as a component of SUSE Linux Enterprise Server 11 SP4 wpa_supplicant-0.7.1-6.18.3.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the four-way handshake, allowing an attacker within radio range to replay frames from access points to clients. CVE-2017-13078 SUSE Linux Enterprise Point of Sale 11 SP3:wpa_supplicant-0.7.1-6.18.3.1 SUSE Linux Enterprise Server 11 SP3-LTSS:wpa_supplicant-0.7.1-6.18.3.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wpa_supplicant-0.7.1-6.18.3.1 SUSE Linux Enterprise Server 11 SP4:wpa_supplicant-0.7.1-6.18.3.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:wpa_supplicant-0.7.1-6.18.3.1 important 7.8 AV:A/AC:L/Au:N/C:C/I:C/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172752-1/ https://www.suse.com/security/cve/CVE-2017-13078.html CVE-2017-13078 https://bugzilla.suse.com/1056061 SUSE Bug 1056061 https://bugzilla.suse.com/1063479 SUSE Bug 1063479 https://bugzilla.suse.com/1063667 SUSE Bug 1063667 https://bugzilla.suse.com/1179588 SUSE Bug 1179588 Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11w allows reinstallation of the Integrity Group Temporal Key (IGTK) during the four-way handshake, allowing an attacker within radio range to spoof frames from access points to clients. CVE-2017-13079 SUSE Linux Enterprise Point of Sale 11 SP3:wpa_supplicant-0.7.1-6.18.3.1 SUSE Linux Enterprise Server 11 SP3-LTSS:wpa_supplicant-0.7.1-6.18.3.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wpa_supplicant-0.7.1-6.18.3.1 SUSE Linux Enterprise Server 11 SP4:wpa_supplicant-0.7.1-6.18.3.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:wpa_supplicant-0.7.1-6.18.3.1 important 7.8 AV:A/AC:L/Au:N/C:C/I:C/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172752-1/ https://www.suse.com/security/cve/CVE-2017-13079.html CVE-2017-13079 https://bugzilla.suse.com/1056061 SUSE Bug 1056061 https://bugzilla.suse.com/1063479 SUSE Bug 1063479 https://bugzilla.suse.com/1179588 SUSE Bug 1179588 Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the group key handshake, allowing an attacker within radio range to replay frames from access points to clients. CVE-2017-13080 SUSE Linux Enterprise Point of Sale 11 SP3:wpa_supplicant-0.7.1-6.18.3.1 SUSE Linux Enterprise Server 11 SP3-LTSS:wpa_supplicant-0.7.1-6.18.3.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wpa_supplicant-0.7.1-6.18.3.1 SUSE Linux Enterprise Server 11 SP4:wpa_supplicant-0.7.1-6.18.3.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:wpa_supplicant-0.7.1-6.18.3.1 important 7.8 AV:A/AC:L/Au:N/C:C/I:C/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172752-1/ https://www.suse.com/security/cve/CVE-2017-13080.html CVE-2017-13080 https://bugzilla.suse.com/1056061 SUSE Bug 1056061 https://bugzilla.suse.com/1063479 SUSE Bug 1063479 https://bugzilla.suse.com/1063667 SUSE Bug 1063667 https://bugzilla.suse.com/1063671 SUSE Bug 1063671 https://bugzilla.suse.com/1066295 SUSE Bug 1066295 https://bugzilla.suse.com/1105108 SUSE Bug 1105108 https://bugzilla.suse.com/1178872 SUSE Bug 1178872 https://bugzilla.suse.com/1179588 SUSE Bug 1179588 Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11w allows reinstallation of the Integrity Group Temporal Key (IGTK) during the group key handshake, allowing an attacker within radio range to spoof frames from access points to clients. CVE-2017-13081 SUSE Linux Enterprise Point of Sale 11 SP3:wpa_supplicant-0.7.1-6.18.3.1 SUSE Linux Enterprise Server 11 SP3-LTSS:wpa_supplicant-0.7.1-6.18.3.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wpa_supplicant-0.7.1-6.18.3.1 SUSE Linux Enterprise Server 11 SP4:wpa_supplicant-0.7.1-6.18.3.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:wpa_supplicant-0.7.1-6.18.3.1 important 7.8 AV:A/AC:L/Au:N/C:C/I:C/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172752-1/ https://www.suse.com/security/cve/CVE-2017-13081.html CVE-2017-13081 https://bugzilla.suse.com/1056061 SUSE Bug 1056061 https://bugzilla.suse.com/1063479 SUSE Bug 1063479 https://bugzilla.suse.com/1066295 SUSE Bug 1066295 https://bugzilla.suse.com/1105108 SUSE Bug 1105108 https://bugzilla.suse.com/1179588 SUSE Bug 1179588 Wi-Fi Protected Access (WPA and WPA2) that support 802.11v allows reinstallation of the Group Temporal Key (GTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame, allowing an attacker within radio range to replay frames from access points to clients. CVE-2017-13087 SUSE Linux Enterprise Point of Sale 11 SP3:wpa_supplicant-0.7.1-6.18.3.1 SUSE Linux Enterprise Server 11 SP3-LTSS:wpa_supplicant-0.7.1-6.18.3.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wpa_supplicant-0.7.1-6.18.3.1 SUSE Linux Enterprise Server 11 SP4:wpa_supplicant-0.7.1-6.18.3.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:wpa_supplicant-0.7.1-6.18.3.1 important 7.8 AV:A/AC:L/Au:N/C:C/I:C/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172752-1/ https://www.suse.com/security/cve/CVE-2017-13087.html CVE-2017-13087 https://bugzilla.suse.com/1056061 SUSE Bug 1056061 https://bugzilla.suse.com/1063479 SUSE Bug 1063479 https://bugzilla.suse.com/1179588 SUSE Bug 1179588 Wi-Fi Protected Access (WPA and WPA2) that support 802.11v allows reinstallation of the Integrity Group Temporal Key (IGTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame, allowing an attacker within radio range to replay frames from access points to clients. CVE-2017-13088 SUSE Linux Enterprise Point of Sale 11 SP3:wpa_supplicant-0.7.1-6.18.3.1 SUSE Linux Enterprise Server 11 SP3-LTSS:wpa_supplicant-0.7.1-6.18.3.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wpa_supplicant-0.7.1-6.18.3.1 SUSE Linux Enterprise Server 11 SP4:wpa_supplicant-0.7.1-6.18.3.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:wpa_supplicant-0.7.1-6.18.3.1 important 7.8 AV:A/AC:L/Au:N/C:C/I:C/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172752-1/ https://www.suse.com/security/cve/CVE-2017-13088.html CVE-2017-13088 https://bugzilla.suse.com/1056061 SUSE Bug 1056061 https://bugzilla.suse.com/1063479 SUSE Bug 1063479 https://bugzilla.suse.com/1179588 SUSE Bug 1179588