MiracleLinux 7 : wpa_supplicant-2.6-5.el7.1 (AXSA:2017-2342:03)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The package checks in this plugin were extracted from
# Miracle Linux Security Advisory AXSA:2017-2342:03.
##

include('compat.inc');

if (description)
{
  script_id(291543);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/01/19");

  script_cve_id(
    "CVE-2017-13077",
    "CVE-2017-13078",
    "CVE-2017-13080",
    "CVE-2017-13082",
    "CVE-2017-13086",
    "CVE-2017-13087",
    "CVE-2017-13088"
  );

  script_name(english:"MiracleLinux 7 : wpa_supplicant-2.6-5.el7.1 (AXSA:2017-2342:03)");

  script_set_attribute(attribute:"synopsis", value:
"The remote MiracleLinux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote MiracleLinux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the
AXSA:2017-2342:03 advisory.

    * A new exploitation technique called key reinstallation attacks (KRACK) affecting WPA2 has been
    discovered. A remote attacker within Wi-Fi range could exploit these attacks to decrypt Wi-Fi traffic or
    possibly inject forged Wi-Fi packets by manipulating cryptographic handshakes used by the WPA2 protocol.
    (CVE-2017-13077, CVE-2017-13078, CVE-2017-13080, CVE-2017-13082, CVE-2017-13086, CVE-2017-13087,
    CVE-2017-13088)
    Asianux would like to thank CERT for reporting these issues. Upstream
    acknowledges Mathy Vanhoef (University of Leuven) as the original reporter of
    these issues.
    CVE-2017-13077
    Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the
    Pairwise Transient Key (PTK) Temporal Key (TK) during the four-way
    handshake, allowing an attacker within radio range to replay, decrypt,
    or spoof frames.
    CVE-2017-13078
    Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the
    Group Temporal Key (GTK) during the four-way handshake, allowing an
    attacker within radio range to replay frames from access points to
    clients.
    CVE-2017-13080
    Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the
    Group Temporal Key (GTK) during the group key handshake, allowing an
    attacker within radio range to replay frames from access points to
    clients.
    CVE-2017-13082
    Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11r
    allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key
    (TK) during the fast BSS transmission (FT) handshake, allowing an
    attacker within radio range to replay, decrypt, or spoof frames.
    CVE-2017-13086
    Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the
    Tunneled Direct-Link Setup (TDLS) Peer Key (TPK) during the TDLS
    handshake, allowing an attacker within radio range to replay, decrypt,
    or spoof frames.
    CVE-2017-13087
    Wi-Fi Protected Access (WPA and WPA2) that support 802.11v allows
    reinstallation of the Group Temporal Key (GTK) when processing a
    Wireless Network Management (WNM) Sleep Mode Response frame, allowing
    an attacker within radio range to replay frames from access points to
    clients.
    CVE-2017-13088
    Wi-Fi Protected Access (WPA and WPA2) that support 802.11v allows
    reinstallation of the Integrity Group Temporal Key (IGTK) when
    processing a Wireless Network Management (WNM) Sleep Mode Response
    frame, allowing an attacker within radio range to replay frames from
    access points to clients.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://tsn.miraclelinux.com/en/node/8782");
  script_set_attribute(attribute:"solution", value:
"Update the affected wpa_supplicant package.");
  script_set_cvss_base_vector("CVSS2#AV:A/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-13082");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"vendor_severity", value:"High");

  script_set_attribute(attribute:"vuln_publication_date", value:"2017/10/10");
  script_set_attribute(attribute:"patch_publication_date", value:"2017/10/23");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/01/19");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:wpa_supplicant");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:miracle:linux:7");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Miracle Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/MiracleLinux/release", "Host/MiracleLinux/rpm-list", "Host/cpu");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'MIRACLE LINUX' >!< os_product) audit(AUDIT_OS_NOT, 'MIRACLE LINUX');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'MIRACLE LINUX');
if (! preg(pattern:"^7([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'MiracleLinux 7.x', 'MIRACLE LINUX ' + os_version);

if (!get_kb_item('Host/MiracleLinux/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'ppc' >!< cpu && 's390' >!< cpu && 'x86_64' >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'MIRACLE LINUX', cpu);

var constraints = [
  {
    'release': '7',
    'pkgs': [
      {'reference':'wpa_supplicant-2.6-5.el7.1', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}
if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'wpa_supplicant');
}