Skip to main content
bommi
bommi
New Member
October 16, 2017
Question

WPA2 security issue "KRACK"

  • October 16, 2017
  • 2 replies
  • 34935 views

Hi,

 

are you aware of the latest security issue with wpa2 called "KRACK":

https://www.theregister.co.uk/2017/10/16/wpa2_inscure_krackattack/

 

At least Aruba and Ubiquiti already have some patch for this issue, what about Fortinet?

Is this relevant for FortiAP and also FortiWifi?

 

Regards

Dominik

    2 replies

    Maik
    Maik
    New Member
    October 16, 2017

    From the Release notes:

    FortiAP 5.6.1 is no longer vulnerable to the following CVE Reference:  CVE-2016-7406  CVE-2016-7407  CVE-2016-7408  CVE-2016-7409  CVE-2016-10229  CVE-2017-13077  CVE-2017-13078  CVE-2017-13079  CVE-2017-13080  CVE-2017-13081  CVE-2017-13082

    ronalds_567
    ronalds_567
    New Member
    October 16, 2017

    Hi

    How about these CVEs?

    CVE-2017-13084, CVE-2017-13086, CVE-2017-13087, and CVE-2017-13088

     

    CyberNorris
    CyberNorris
    New Member
    October 16, 2017

    As previously mentioned FortiAP 5.6.1 is no longer vulnerable to over half of the Krack CVEs.

     

    Latest 5.4.x branch for FortiAP is 5.4.3 (release notes dated 21JUN17) and FortiAP-S and FortiAP-W2 5.4.4 (release notes dated 11JUL17). Neither mentions any of the Krack CVE numbers.

     

    Be on the lookout for firmware updates. I post them usually pretty quickly on Twitter @FortinetGuide

     

    Kommissar
    Kommissar
    New Member
    October 16, 2017

    What about the 5.4.x branch?

    itsupport7
    itsupport7
    New Member
    October 16, 2017

    We are also waiting for this updated firmware for a 221B!

     

    The vulnerability indicates it is a WPA2 general vulnerability affecting the reuse of the nonce on one side of the session key exchange so it should affect any WPA2 implementation, does that sound correct?

    Terms & ConditionsAccessibility statement