VAR-200811-0398

Vulnerability from variot - Updated: 2025-04-10 23:11

The Temporal Key Integrity Protocol (TKIP) implementation in unspecified Cisco products and other vendors' products, as used in WPA and WPA2 on Wi-Fi networks, has insufficient countermeasures against certain crafted and replayed packets, which makes it easier for remote attackers to decrypt packets from an access point (AP) to a client and spoof packets from an AP to a client, and conduct ARP poisoning attacks or other attacks, as demonstrated by tkiptun-ng. Wi-Fi Protected Access (WPA) Encryption Standard is prone to an encryption-bypass vulnerability that affects the Temporal Key Integrity Protocol (TKIP) key. Attackers can exploit this issue to overcome the WPA encryption algorithm and read encrypted data sent from a wireless router to a computer. This may allow attackers to obtain potentially sensitive information; other attacks are also possible. If a remote attacker sends a specially crafted playback message, it may be easier to crack the client's packets, and then perform ARP spoofing or other attacks. Please note that this attack is not a key recovery attack. The attacker can only recover the key used to authenticate the message but not the key used to encrypt and obfuscate data, and can only use the recovered key to forge captured packets. Wen, with a window of opportunity of up to 7 attempts. Each attack can only decrypt one message, and the time spent is about 12-15 minutes

Show details on source website
To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-200811-0398",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "ios",
        "scope": null,
        "trust": 1.4,
        "vendor": "cisco",
        "version": null
      },
      {
        "model": "ios",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "*"
      },
      {
        "model": "alliance wpa",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "wi fi",
        "version": "0"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "32164"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2008-002386"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200811-401"
      },
      {
        "db": "NVD",
        "id": "CVE-2008-5230"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/o:cisco:ios",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2008-002386"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Erik TewsMartin Beck",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200811-401"
      }
    ],
    "trust": 0.6
  },
  "cve": "CVE-2008-5230",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 8.6,
            "id": "CVE-2008-5230",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 1.8,
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 8.6,
            "id": "VHN-35355",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 0.1,
            "vectorString": "AV:N/AC:M/AU:N/C:P/I:P/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2008-5230",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "NVD",
            "id": "CVE-2008-5230",
            "trust": 0.8,
            "value": "Medium"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-200811-401",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "VULHUB",
            "id": "VHN-35355",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-35355"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2008-002386"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200811-401"
      },
      {
        "db": "NVD",
        "id": "CVE-2008-5230"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "The Temporal Key Integrity Protocol (TKIP) implementation in unspecified Cisco products and other vendors\u0027 products, as used in WPA and WPA2 on Wi-Fi networks, has insufficient countermeasures against certain crafted and replayed packets, which makes it easier for remote attackers to decrypt packets from an access point (AP) to a client and spoof packets from an AP to a client, and conduct ARP poisoning attacks or other attacks, as demonstrated by tkiptun-ng. Wi-Fi Protected Access (WPA) Encryption Standard is prone to an encryption-bypass vulnerability that affects the Temporal Key Integrity Protocol (TKIP) key. \nAttackers can exploit this issue to overcome the WPA encryption algorithm and read encrypted data sent from a wireless router to a computer.  This may allow attackers to obtain potentially sensitive information; other attacks are also possible. If a remote attacker sends a specially crafted playback message, it may be easier to crack the client\u0027s packets, and then perform ARP spoofing or other attacks. Please note that this attack is not a key recovery attack. The attacker can only recover the key used to authenticate the message but not the key used to encrypt and obfuscate data, and can only use the recovered key to forge captured packets. Wen, with a window of opportunity of up to 7 attempts. Each attack can only decrypt one message, and the time spent is about 12-15 minutes",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2008-5230"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2008-002386"
      },
      {
        "db": "BID",
        "id": "32164"
      },
      {
        "db": "VULHUB",
        "id": "VHN-35355"
      }
    ],
    "trust": 1.98
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2008-5230",
        "trust": 2.8
      },
      {
        "db": "BID",
        "id": "32164",
        "trust": 2.0
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2008-002386",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200811-401",
        "trust": 0.7
      },
      {
        "db": "CISCO",
        "id": "20081121 CISCO RESPONSE TO TKIP ENCRYPTION WEAKNESS",
        "trust": 0.6
      },
      {
        "db": "MLIST",
        "id": "[DAILYDAVE] 20081107 ALL UR WIFI(WPA) R BELONG 2 PACSEC",
        "trust": 0.6
      },
      {
        "db": "VULHUB",
        "id": "VHN-35355",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-35355"
      },
      {
        "db": "BID",
        "id": "32164"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2008-002386"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200811-401"
      },
      {
        "db": "NVD",
        "id": "CVE-2008-5230"
      }
    ]
  },
  "id": "VAR-200811-0398",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-35355"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2025-04-10T23:11:23.088000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "cisco-sr-20081121-wpa",
        "trust": 0.8,
        "url": "http://www.cisco.com/warp/public/707/cisco-sr-20081121-wpa.shtml"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2008-002386"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-310",
        "trust": 1.9
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-35355"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2008-002386"
      },
      {
        "db": "NVD",
        "id": "CVE-2008-5230"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.0,
        "url": "http://www.cisco.com/en/us/products/products_security_response09186a0080a30036.html"
      },
      {
        "trust": 1.7,
        "url": "http://www.securityfocus.com/bid/32164"
      },
      {
        "trust": 1.7,
        "url": "http://arstechnica.com/articles/paedia/wpa-cracked.ars"
      },
      {
        "trust": 1.7,
        "url": "http://dl.aircrack-ng.org/breakingwepandwpa.pdf"
      },
      {
        "trust": 1.7,
        "url": "http://radajo.blogspot.com/2008/11/wpatkip-chopchop-attack.html"
      },
      {
        "trust": 1.7,
        "url": "http://trac.aircrack-ng.org/svn/trunk/src/tkiptun-ng.c"
      },
      {
        "trust": 1.7,
        "url": "http://www.aircrack-ng.org/doku.php?id=tkiptun-ng"
      },
      {
        "trust": 1.7,
        "url": "http://lists.immunitysec.com/pipermail/dailydave/2008-november/005413.html"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2008-5230"
      },
      {
        "trust": 0.8,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2008-5230"
      },
      {
        "trust": 0.3,
        "url": "http://www.computerworld.com/action/article.do?command=viewarticlebasic\u0026articleid=9119258"
      },
      {
        "trust": 0.3,
        "url": "http://www.wi-fi.org/knowledge_center/wpa"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-35355"
      },
      {
        "db": "BID",
        "id": "32164"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2008-002386"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200811-401"
      },
      {
        "db": "NVD",
        "id": "CVE-2008-5230"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-35355"
      },
      {
        "db": "BID",
        "id": "32164"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2008-002386"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200811-401"
      },
      {
        "db": "NVD",
        "id": "CVE-2008-5230"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2008-11-25T00:00:00",
        "db": "VULHUB",
        "id": "VHN-35355"
      },
      {
        "date": "2008-11-06T00:00:00",
        "db": "BID",
        "id": "32164"
      },
      {
        "date": "2009-07-08T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2008-002386"
      },
      {
        "date": "2008-11-25T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-200811-401"
      },
      {
        "date": "2008-11-25T23:30:00.593000",
        "db": "NVD",
        "id": "CVE-2008-5230"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2008-12-03T00:00:00",
        "db": "VULHUB",
        "id": "VHN-35355"
      },
      {
        "date": "2015-05-07T17:21:00",
        "db": "BID",
        "id": "32164"
      },
      {
        "date": "2009-07-08T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2008-002386"
      },
      {
        "date": "2008-12-03T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-200811-401"
      },
      {
        "date": "2025-04-09T00:30:58.490000",
        "db": "NVD",
        "id": "CVE-2008-5230"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200811-401"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Of unspecified Cisco products and other vendor products  TKIP Packet decryption in / Impersonation and ARP Vulnerability such as performing poisoning",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2008-002386"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "encryption problem",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200811-401"
      }
    ],
    "trust": 0.6
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.