Voltar
-
Título
Information Regarding Key Re-installation Attacks (KRACK) -
Descrição
A weakness in the WPA2 Wi-Fi Protocol has been discovered that attackers can use to read information on the wireless network that was previously assumed to be encrypted.
The following Common Vulnerabilities and Exposures (CVE) identifiers were assigned to track which products are affected by specific instantiations of our key reinstallation attack:
- CVE-2017-13077: Reinstallation of the pairwise encryption key (PTK-TK) in the 4-way handshake.
- CVE-2017-13078: Reinstallation of the group key (GTK) in the 4-way handshake.
- CVE-2017-13079: Reinstallation of the integrity group key (IGTK) in the 4-way handshake.
- CVE-2017-13080: Reinstallation of the group key (GTK) in the group key handshake.
- CVE-2017-13081: Reinstallation of the integrity group key (IGTK) in the group key handshake.
- CVE-2017-13082: Accepting a retransmitted Fast BSS Transition (FT) Reassociation Request and reinstalling the pairwise encryption key (PTK-TK) while processing it.
- CVE-2017-13084: Reinstallation of the STK key in the PeerKey handshake.
- CVE-2017-13086: reinstallation of the Tunneled Direct-Link Setup (TDLS) PeerKey (TPK) key in the TDLS handshake.
- CVE-2017-13087: reinstallation of the group key (GTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame.
- CVE-2017-13088: reinstallation of the integrity group key (IGTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame.
Details information about this is available at:
- https://www.krackattacks.com/
-
Resolução
Systems patched with October 10, 2017 patches are immune to this attack.
Microsoft's information concerning CVE-2017-13080 and the list of patches KB numbers can be found in: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-13080
For more information, please contact Microsoft support.