WPA2 security issue "KRACK"

[bommi]

Hi,

are you aware of the latest security issue with wpa2 called "KRACK":

https://www.theregister.co.uk/2017/10/16/wpa2_inscure_krackattack/

At least Aruba and Ubiquiti already have some patch for this issue, what about Fortinet?

Is this relevant for FortiAP and also FortiWifi?

Regards

Dominik

[Maik]

From the Release notes:

FortiAP 5.6.1 is no longer vulnerable to the following CVE Reference:  CVE-2016-7406  CVE-2016-7407  CVE-2016-7408  CVE-2016-7409  CVE-2016-10229  CVE-2017-13077  CVE-2017-13078  CVE-2017-13079  CVE-2017-13080  CVE-2017-13081  CVE-2017-13082

[ronalds_567]

Hi

How about these CVEs?

CVE-2017-13084, CVE-2017-13086, CVE-2017-13087, and CVE-2017-13088

[CyberNorris]

As previously mentioned FortiAP 5.6.1 is no longer vulnerable to over half of the Krack CVEs.

Latest 5.4.x branch for FortiAP is 5.4.3 (release notes dated 21JUN17) and FortiAP-S and FortiAP-W2 5.4.4 (release notes dated 11JUL17). Neither mentions any of the Krack CVE numbers.

Be on the lookout for firmware updates. I post them usually pretty quickly on Twitter @FortinetGuide

[bommi]

There is now an official Advisory on this issue:

[link]http://fortiguard.com/psirt/FG-IR-17-196[/link]

[CyberNorris]

itsupport@geddesfederal.com wrote:

We are also waiting for this updated firmware for a 221B!  The vulnerability indicates it is a WPA2 general vulnerability affecting the reuse of the nonce on one side of the session key exchange so it should affect any WPA2 implementation, does that sound correct?

Yes, it is a general WPA2 vulnerability affecting everything from home routers to top commercial systems. If your FAP 221B is likely managed by a FortiGate, FortiOS needs updated firmware as well as the AP firmware.

Fortinet released a PSIRT around lunch time today on the issue and announced firmware versions pending release. So stay tuned.

Good catch, @bommi

bommi wrote:

There is now an official Advisory on this issue:

http://fortiguard.com/psirt/FG-IR-17-196

Find Fortinet firmware update notifications on Twitter @FortinetGuide

[Matthijs]

Can you please also clarify this one:

For FortiAP:

Only affect FortiAP which is working as a mesh leaf.

[CyberNorris]

Matthijs wrote:

Can you please also clarify this one:

For FortiAP:

Only affect FortiAP which is working as a mesh leaf.

A mesh network is where you use multiple APs to extend the network ... so AP2 (and its clients) are connected to the rest of the network by connecting to AP1.

Here's a Cookbook article on it: http://cookbook.fortinet....ge-with-mesh-topology/

[Milaan]

As far as i understood the Advisory only FortiWiFi Models are affected and FortiAP's Operating as Mesh/Leaf?

Since we use a FortiGate and FortiAP NOT in Mesh/Leaf Mode, we are not affected, right?

[cdneufeld]

I haven't seen anything about the FortiWLC and updates on that front yet. Has anyone else?