Critical Vulnerability in Hostapd and Wpa_supplicant: CVE-2017-13082
Summary
ALPINE-CVE-2017-13082: Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11r allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key (TK) during the fast BSS transmission (FT) handshake, allowing an attacker within ra... Affects hostapd versions < 2.6-r2. Fixed in 2.6-r2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Hostapd and Wpa_supplicant are essential components in managing wireless networks, providing functionalities such as authentication and encryption for Wi-Fi connections. Hostapd allows access point and authentication server functionalities, while Wpa_supplicant manages the wireless connection and security protocols. The vulnerability identified as CVE-2017-13082 affects both packages, exposing them to potential attacks that could compromise network security.
Vulnerability Detail
The vulnerability arises from the Wi-Fi Protected Access (WPA and WPA2) implementation that supports IEEE 802.11r. It allows the reinstallation of the Pairwise Transient Key (PTK) Temporal Key (TK) during the fast BSS transition (FT) handshake. This flaw enables an attacker within radio range to replay, decrypt, or spoof frames, leading to unauthorized access and potential data breaches. The CVSS score for this vulnerability is 8.1, indicating a high severity level.
How To Fix
Minimum fixed version
2.6-r2
This is the first release that contains the fix.
sudo apk add --upgrade hostapdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider disabling the fast BSS transition feature in your wireless configuration to mitigate the risk until the packages are updated.
Conclusion
CVE-2017-13082 is a critical vulnerability in Hostapd and Wpa_supplicant that poses significant risks to wireless network security. It is essential to update to the patched versions to mitigate these risks effectively. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for hostapd →
FAQ
CVE-2017-13082 is a vulnerability affecting Hostapd and Wpa_supplicant that allows attackers to exploit the WPA/WPA2 protocols, potentially leading to unauthorized access.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability can allow attackers to decrypt sensitive data, spoof network traffic, and gain unauthorized access to the network.
Yes, the patched version for Hostapd and Wpa_supplicant is 2.6-r2 for Alpine v3.10 and later.
If immediate updates are not possible, consider disabling the fast BSS transition feature as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for hostapd.
