MikroTik Information for VU#228519

Wi-Fi Protected Access (WPA) handshake traffic can be manipulated to induce nonce and session key reuse

Status

Not Affected

Vendor Statement

On October 16. CERT/CC/ICASI released a public announcement about discovered vulnerabilities in WPA2 handshake protocols that affect most WiFi users and all vendors world wide.

    RouterOS v6.39.3, v6.40.4, v6.41rc are not affected!
    It is important to note that the vulnerability is discovered in the protocol itself, so even a correct implementation is affected.
    These organizations did contact us earlier, so we have already released fixed versions that address the outlined issues. Not all of the discovered vulnerabilities directly impact RouterOS users, or even apply to RouterOS, but we did follow all recommendations and improved the key exchange process according to the guidelines we received from the organizations who discovered the issue.
    We released fixed versions last week, so if you upgrade your devices routinely, no further action is required.
    CWE-323
    CVE-2017-13077
    CVE-2017-13078
    CVE-2017-13079
    CVE-2017-13080
    CVE-2017-13081
    CVE-2017-13082
    CVE-2017-13083
    CVE-2017-13084
    CVE-2017-13085
    CVE-2017-13086
    CVE-2017-13087

    The following applies to RouterOS software prior to updates related to the issue.

    nv2
    nv2 is not affected in any way. This applies to both - nv2 AP and client. There is no nonce reset in key exchange possible and key re-installation is not possible, because nv2 key exchange does not directly follow 802.11 key exchange specification.

    802.11 nonce reuse
    RouterOS is not affected in any way, RouterOS generates cryptographically strong random initial nonce on boot and never reuses the same nonce during uptime.

    802.11 key reinstallation
    The device operating as client in key exchange is affected by this issue. This means that RouterOS in station modes and APs that establish WDS links with other APs are affected. RouterOS APs (both - standalone and CAPsMAN controlled), that do not establish WDS links with other APs, are not affected. Key reinstallation by resending key exchange frame allows attacker to reset encrypted frame packet counter. This allows attacker to replay frames that where previously sent by AP to client. Please note that RouterOS DOES NOT reset key to some known value that would allow attacker to inject/decrypt any frames to/from client.

    Suggested course of action
    It is always recommended to upgrade to latest RouterOS version, but depending on wireless protocol and mode the suggested course of action is as follows:
    - nv2: no action necessary
    - 802.11/nstreme AP without WDS: no action necessary
    - CAPsMAN: no action necessary
    - 802.11/nstreme client (all station modes) or AP with WDS: upgrade to fixed version ASAP.

    Vendor Information

    Though Mikrotik has self-identified as not affected, they have published updates that "improved WPA2 key exchange reliability" (see https://mikrotik.com/download/changelogs).

    Vendor References

    https://forum.mikrotik.com/viewtopic.php?f=21&t=126695#p623324

    Addendum

    There are no additional comments at this time.

    If you have feedback, comments, or additional information about this vulnerability, please send us email.