The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Aruba Networks Unauthorized Administrative and WLAN Access through Guest
Account
------------------------------------------------------------------------
SUMMARY
A flaw in an authorization component allows for unauthorized access to the
Wireless LAN through a Captive Portal, VPN, and administrative access
using either the web-based administration or the command line interface.
This vulnerability affects all versions of the Aruba Controller beginning
with version 2.3.
DETAILS
Systems Affected:
* All Aruba Networks Mobility Controllers (200, 800, 2400, and 6000)
running software versions greater than 2.0 Alcatel-Lucent OmniAccess
Wireless 43xx and 6000 running software versions 2.0 and later.
Impact:
If the management interfaces are reachable, an attacker can gain full
control over the device through this account. Likewise, an attacker may
gain unauthorized access to the WLAN, if no other security safeguards such
as WPA-PSK are in place. If WLAN access control is enforced through VPN
client authentication, a compromise of the WLAN is possible if the
attacker can provide the group key for the VPN.
Solution:
Aruba Networks has made patched firmware available to their customers, who
should be able to retrieve it through Aruba's support site
<https://support.arubanetworks.com> https://support.arubanetworks.com. As
a workaround, restrict access to the administrative interfaces or disable
them, reverting to console-only administration.
* Disable the Captive Portal.
* Require MSCHAPv2 for VPN authentication.
Vendor communication:
2007/01/11 - Initial notification to Aruba WSIRT
2007/01/11 - Aruba WSIRT assigns contact
2007/01/15 - Aruba provides feedback on the vulnerability.
2007/01/18 - Patches available
2007/01/28 - n.runs verifies patched firmware
ADDITIONAL INFORMATION
The information has been provided by <mailto:security@nruns.com> n.runs.
The original article can be found at: <http://www.nruns.com/>
http://www.nruns.com/
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
