AirPort firmware updates arrive with KRACK vulnerability fix

Apple has today released firmware updates for its AirPort devices, including the AirPort Time Capsule, AirPort Extreme, and AirPort Express. These updates include fixes for the KRACK and Broadpwn vulnerabilities.

The 7.6.9 update is for 801.11n base stations and the 7.7.9 updateis for 802.11ac models. These updates provide important security patches for the KRACK and Broadpwn exploits.

Users may not see any prompt for the firmware upgrade, but can manually do so by opening AirPort Utility on Mac or iOS. Select your AirPort device and click Update.

Release notes:

AirPort Base Station Firmware

Available for: AirPort Extreme and AirPort Time Capsule base stations with 802.11ac

Impact: An attacker within range may be able to execute arbitrary code on the Wi-Fi chip

Description: A memory corruption issue was addressed with improved memory handling.

CVE-2017-9417: Nitay Artenstein of Exodus Intelligence

AirPort Base Station Firmware

Available for: AirPort Extreme and AirPort Time Capsule base stations with 802.11ac

Impact: An attacker in Wi-Fi range may force nonce reuse in WPA unicast/PTK clients (Key Reinstallation Attacks – KRACK)

Description: A logic issue existed in the handling of state transitions. This was addressed with improved state management.

CVE-2017-13077: Mathy Vanhoef of the imec-DistriNet group at KU Leuven

CVE-2017-13078: Mathy Vanhoef of the imec-DistriNet group at KU Leuven

AirPort Base Station Firmware

Available for: AirPort Extreme and AirPort Time Capsule base stations with 802.11ac

Impact: An attacker in Wi-Fi range may force nonce reuse in WPA multicast/GTK clients (Key Reinstallation Attacks – KRACK)

Description: A logic issue existed in the handling of state transitions. This was addressed with improved state management.

CVE-2017-13080: Mathy Vanhoef of the imec-DistriNet group at KU Leuven

AirPort Base Station Firmware

Available for: AirPort Express, AirPort Extreme, and AirPort Time Capsule base stations with 802.11n

Impact: An attacker in Wi-Fi range may force nonce reuse in WPA unicast/PTK clients (Key Reinstallation Attacks – KRACK)

Description: A logic issue existed in the handling of state transitions. This was addressed with improved state management.

CVE-2017-13077: Mathy Vanhoef of the imec-DistriNet group at KU Leuven

CVE-2017-13078: Mathy Vanhoef of the imec-DistriNet group at KU Leuven

AirPort Base Station Firmware

Available for: AirPort Express, AirPort Extreme, and AirPort Time Capsule base stations with 802.11n

Impact: An attacker in Wi-Fi range may force nonce reuse in WPA multicast/GTK clients (Key Reinstallation Attacks – KRACK)

Description: A logic issue existed in the handling of state transitions. This was addressed with improved state management.

CVE-2017-13080: Mathy Vanhoef of the imec-DistriNet group at KU Leuven

Advertisements