Date: Mon, 16 Oct 2017 13:06:57 -0700 From: Cy Schubert <Cy.Schubert@komquats.com> To: Cy Schubert <Cy.Schubert@cschubert.com> Cc: Oliver Pinter <oliver.pinter@hardenedbsd.org>, Adrian Chadd <adrian.chadd@gmail.com>, Kevin Oberman <rkoberman@gmail.com>, Cy Schubert <Cy.Schubert@komquats.com>, Lev Serebryakov <lev@freebsd.org>, blubee blubeeme <gurenchan@gmail.com>, Poul-Henning Kamp <phk@phk.freebsd.dk>, FreeBSD current <freebsd-current@freebsd.org> Subject: Re: cve-2017-13077 - WPA2 security vulni Message-ID: <201710162006.v9GK6v7G077342@slippy.cwsent.com> In-Reply-To: Message from Cy Schubert <Cy.Schubert@cschubert.com> of "Mon, 16 Oct 2017 12:36:27 -0700." <201710161936.v9GJaRLo072189@slippy.cwsent.com>
next in thread | previous in thread | raw e-mail | index | archive | help
I'll commit the wpa_supplicant port now but I don't have enough time this lunch hour to create a vuxml entry or to update the hostapd port. It may be simpler to update base to 2.6 to facilitate patching. What do people think? -- Cheers, Cy Schubert <Cy.Schubert@cschubert.com> FreeBSD UNIX: <cy@FreeBSD.org> Web: http://www.FreeBSD.org The need of the many outweighs the greed of the few. In message <201710161936.v9GJaRLo072189@slippy.cwsent.com>, Cy Schubert writes: > Looking at the wpa_supplicant port, it may be a quicker win than base at > the moment. > > I don't have much of my lunch hour left to complete anything. > > > -- > Cheers, > Cy Schubert <Cy.Schubert@cschubert.com> > FreeBSD UNIX: <cy@FreeBSD.org> Web: http://www.FreeBSD.org > > The need of the many outweighs the greed of the few. > > > In message <CAPQ4ffua_eQ24z6a8XSH=CCBbqrXV6vXzMD5QgSGmYi198wX4w@mail.gmail.c > om> > , Oliver Pinter writes: > > Hi Adrian! > > > > How big effort is to update he in-tree wpa_supplicant/hostapd to the > > latest supported version? > > Is there any known regression / feature loss when do the upgrade? > > > > On 10/16/17, Adrian Chadd <adrian.chadd@gmail.com> wrote: > > > Right, there are backported patches against 2.6, but we're running 2.5 > > > in contrib/ . > > > > > > This is all "I'm out of time right now", so if someone wants to do the > > > ports work and/or the contrib work with the patches for this vuln then > > > please do. I should be able to get to it in the next few days but I'm > > > busy with family and employment. > > > > > > > > > > > > -adrian > > > > > > > > > On 16 October 2017 at 10:19, Kevin Oberman <rkoberman@gmail.com> wrote: > > >> On Mon, Oct 16, 2017 at 8:55 AM, Adrian Chadd <adrian.chadd@gmail.com> > > >> wrote: > > >>> > > >>> hi, > > >>> > > >>> I got the patches a couple days ago. I've been busy with personal life > > >>> stuff so I haven't updated our in-tree hostapd/wpa_supplicant. If > > >>> someone beats me to it, great, otherwise I'll try to do it in the next > > >>> couple days. > > >>> > > >>> I was hoping (!) for a hostap/wpa_supplicant 2.7 update to just update > > >>> everything to but so far nope. It should be easy enough to update the > > >>> port for now as it's at 2.6. > > >>> > > >>> > > >>> > > >>> -adrian > > >>> > > >>> > > >>> On 16 October 2017 at 06:04, Cy Schubert <Cy.Schubert@komquats.com> > > >>> wrote: > > >>> > In message <44161b4d-f834-a01d-6ddb-475f208762f9@FreeBSD.org>, Lev > > >>> > Serebryakov > > >>> > writes: > > >>> >> On 16.10.2017 13:38, blubee blubeeme wrote: > > >>> >> > > >>> >> > well, that's a cluster if I ever seen one. > > >>> >> It is really cluster: CVE-2017-13077, CVE-2017-13078, > > >>> >> CVE-2017-13079, > > >>> >> CVE-2017-13080, CVE-2017-13081, CVE-2017-13082, CVE-2017-13084, > > >>> >> CVE-2017-13086,CVE-2017-13087, CVE-2017-13088. > > >>> > > > >>> > The gory details are here: > > >>> > https://w1.fi/security/2017-1/wpa-packet-number-reuse-with-replayed-m > es > > sages.txt > > >>> > > > >>> > The announcement is here: > > >>> > https://www.krackattacks.com/ > > >>> > > > >>> > > > >>> > -- > > >>> > Cheers, > > >>> > Cy Schubert <Cy.Schubert@cschubert.com> > > >>> > FreeBSD UNIX: <cy@FreeBSD.org> Web: http://www.FreeBSD.org > > >>> > > > >>> > The need of the many outweighs the greed of the few. > > >>> > > > >> > > >> > > >> While I do not encourage waiting, it is quite likely that the upstream > > >> patch > > >> wil show up very soon now that the vulnerability is public. > > >> > > >> It's also worth noting that fixing either end of the connection is all > > >> that > > >> is required, as I understand it. So getting an update for your AP is not > > >> required. That is very fortunate as the industry has a rather poor recor > d > > >> of > > >> getting out firmware updates for hardware more than a few months old. > > >> Also, > > >> it appears that Windows and iOS are not vulnerable due to flaws in their > > >> implementation of the WPA2 spec. (Of course, if you update your AP(s), > > >> you > > >> no longer need to worry about your end devices. > > >> -- > > >> Kevin Oberman, Part time kid herder and retired Network Engineer > > >> E-mail: rkoberman@gmail.com > > >> PGP Fingerprint: D03FB98AFA78E3B78C1694B318AB39EF1B055683 > > > _______________________________________________ > > > freebsd-current@freebsd.org mailing list > > > https://lists.freebsd.org/mailman/listinfo/freebsd-current > > > To unsubscribe, send any mail to "freebsd-current-unsubscribe@freebsd.org > " > > > >
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201710162006.v9GK6v7G077342>