Date: Fri, 7 Sep 2018 03:49:46 +0000 (UTC) From: Cy Schubert <cy@FreeBSD.org> To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r479178 - head/security/vuxml Message-ID: <201809070349.w873nkT9032390@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: cy Date: Fri Sep 7 03:49:46 2018 New Revision: 479178 URL: https://svnweb.freebsd.org/changeset/ports/479178 Log: Remove duplicate entry for WPA EAPOL vulnerability. Use r477829 instead as its version range is more complete. PR: 231054 Reported by: 000.fbsd@quip.cz Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Fri Sep 7 03:25:50 2018 (r479177) +++ head/security/vuxml/vuln.xml Fri Sep 7 03:49:46 2018 (r479178) @@ -761,76 +761,6 @@ Notes: </dates> </vuln> - <vuln vid="6bedc863-9fbe-11e8-945f-206a8a720317"> - <topic>wpa_supplicant -- unauthenticated encrypted EAPOL-Key data</topic> - <affects> - <package> - <name>wpa_supplicant</name> - <range><lt>2.6_2</lt></range> - </package> - <package> - <name>FreeBSD</name> - <range><le>10.4_10</le></range> - <range><le>11.2_1</le></range> - </package> - </affects> - <description> - <body xmlns="http://www.w3.org/1999/xhtml">; - <p>SO-AND-SO reports:</p> - <blockquote cite="INSERT URL HERE"> - <p>A vulnerability was found in how wpa_supplicant processes - EAPOL-Key frames. It is possible for an attacker to modify - the frame in a way that makes wpa_supplicant decrypt the Key - Data field without requiring a valid MIC value in the frame, - i.e., without the frame being authenticated. This has a - potential issue in the case where WPA2/RSN style of EAPOL-Key - construction is used with TKIP negotiated as the pairwise - cipher. It should be noted that WPA2 is not supposed to be - used with TKIP as the pairwise cipher. Instead, CCMP is - expected to be used and with that pairwise cipher, this - vulnerability is not applicable in practice.</p> - <p>When TKIP is negotiated as the pairwise cipher, the EAPOL-Key - Key Data field is encrypted using RC4. This vulnerability - allows unauthenticated EAPOL-Key frames to be processed and - due to the RC4 design, this makes it possible for an attacker - to modify the plaintext version of the Key Data field with - bitwise XOR operations without knowing the contents. This can - be used to cause a denial of service attack by modifying - GTK/IGTK on the station (without the attacker learning any of - the keys) which would prevent the station from accepting - received group-addressed frames. Furthermore, this might be - abused by making wpa_supplicant act as a decryption oracle to - try to recover some of the Key Data payload (GTK/IGTK) to get - knowledge of the group encryption keys.</p> - <p>Full recovery of the group encryption keys requires multiple - attempts (128 connection attempts per octet) and each attempt - results in disconnection due to a failure to complete the 4-way - handshake. These failures can result in the AP/network getting - disabled temporarily or even permanently (requiring user action - to re-enable) which may make it impractical to perform the - attack to recover the keys before the AP has already changes - the group keys. By default, wpa_supplicant is enforcing at - minimum a ten second wait time between each failed connection - attempt, i.e., over 20 minutes waiting to recover each octet - while hostapd AP implementation uses 10 minute default for GTK - rekeying when using TKIP. With such timing behavior, practical - attack would need large number of impacted stations to be - trying to connect to the same AP to be able to recover - sufficient information from the GTK to be able to determine - the key before it gets changed.</p> - </blockquote> - </body> - </description> - <references> - <url>https://w1.fi/security/2018-1/unauthenticated-eapol-key-decryption.txt</url>; - <cvename>CVE-2018-14526</cvename> - </references> - <dates> - <discovery>2018-08-08</discovery> - <entry>2018-08-14</entry> - </dates> - </vuln> - <vuln vid="98b603c8-9ff3-11e8-ad63-6451062f0f7a"> <topic>Flash Player -- multiple vulnerabilities</topic> <affects>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201809070349.w873nkT9032390>