Fortinet Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
bommi
Contributor III

WPA2 security issue "KRACK"

Hi,

 

are you aware of the latest security issue with wpa2 called "KRACK":

https://www.theregister.co.uk/2017/10/16/wpa2_inscure_krackattack/

 

At least Aruba and Ubiquiti already have some patch for this issue, what about Fortinet?

Is this relevant for FortiAP and also FortiWifi?

 

Regards

Dominik

NSE 4/5/7

16 REPLIES 16
Maik
New Contributor

From the Release notes:

FortiAP 5.6.1 is no longer vulnerable to the following CVE Reference:  CVE-2016-7406  CVE-2016-7407  CVE-2016-7408  CVE-2016-7409  CVE-2016-10229  CVE-2017-13077  CVE-2017-13078  CVE-2017-13079  CVE-2017-13080  CVE-2017-13081  CVE-2017-13082

ronalds_567

Hi

How about these CVEs?

CVE-2017-13084, CVE-2017-13086, CVE-2017-13087, and CVE-2017-13088

 

ronalds567
CyberNorris

As previously mentioned FortiAP 5.6.1 is no longer vulnerable to over half of the Krack CVEs.

 

Latest 5.4.x branch for FortiAP is 5.4.3 (release notes dated 21JUN17) and FortiAP-S and FortiAP-W2 5.4.4 (release notes dated 11JUL17). Neither mentions any of the Krack CVE numbers.

 

Be on the lookout for firmware updates. I post them usually pretty quickly on Twitter @FortinetGuide

 

Norris Carden

Fortinet XTreme Team USA (2015, 2016)

CISSP (2005), CISA (2007), NSE4 (2016)

bommi

There is now an official Advisory on this issue:

 

[link]http://fortiguard.com/psirt/FG-IR-17-196[/link]

NSE 4/5/7

CyberNorris
New Contributor III

itsupport@geddesfederal.com wrote:

We are also waiting for this updated firmware for a 221B!  The vulnerability indicates it is a WPA2 general vulnerability affecting the reuse of the nonce on one side of the session key exchange so it should affect any WPA2 implementation, does that sound correct?

 

Yes, it is a general WPA2 vulnerability affecting everything from home routers to top commercial systems. If your FAP 221B is likely managed by a FortiGate, FortiOS needs updated firmware as well as the AP firmware.

 

Fortinet released a PSIRT around lunch time today on the issue and announced firmware versions pending release. So stay tuned.

 

Good catch, @bommi

bommi wrote:

There is now an official Advisory on this issue:

http://fortiguard.com/psirt/FG-IR-17-196

Find Fortinet firmware update notifications on Twitter @FortinetGuide

Norris Carden

Fortinet XTreme Team USA (2015, 2016)

CISSP (2005), CISA (2007), NSE4 (2016)

Matthijs

Can you please also clarify this one:

 

For FortiAP:

Only affect FortiAP which is working as a mesh leaf.

CyberNorris
New Contributor III

Matthijs wrote:

Can you please also clarify this one:

 

For FortiAP:

Only affect FortiAP which is working as a mesh leaf.

A mesh network is where you use multiple APs to extend the network ... so AP2 (and its clients) are connected to the rest of the network by connecting to AP1.

 

Here's a Cookbook article on it: http://cookbook.fortinet....ge-with-mesh-topology/

Norris Carden

Fortinet XTreme Team USA (2015, 2016)

CISSP (2005), CISA (2007), NSE4 (2016)

Milaan
New Contributor II

As far as i understood the Advisory only FortiWiFi Models are affected and FortiAP's Operating as Mesh/Leaf?

 

Since we use a FortiGate and FortiAP NOT in Mesh/Leaf Mode, we are not affected, right?

cdneufeld

I haven't seen anything about the FortiWLC and updates on that front yet. Has anyone else?