The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Aruba Mobility Controller Management Buffer Overflow
------------------------------------------------------------------------
SUMMARY
The Aruba Mobility Controller s management interfaces are susceptible to a
heap based buffer overflow vulnerability.
DETAILS
Systems Affected:
* All Aruba Networks Mobility Controllers (200, 800, 2400, and 6000)
running software versions greater than 2.0 Alcatel-Lucent OmniAccess
Wireless 43xx and 6000 running software versions 2.0 and later.
Details:
Both the command line based and the web based management interface of the
Aruba Mobility Controller are vulnerable to a heap based buffer overflow
when overly long strings are passed as credentials. This can potentially
lead to remote code execution, resulting in a system compromise.
Impact:
The overflow will in any case result in memory corruption that crashes the
management interface s process, leading to a Denial of Service (DoS)
condition of the remote management capabilities. A carefully crafted
overflow may result in code execution, allowing an attacker to fully
control the device.
Solution:
Aruba Networks has made patched firmware available to their customers, who
should be able to retrieve it through Aruba's support site
<https://support.arubanetworks.com> https://support.arubanetworks.com. As
a workaround, restrict access to the administrative interfaces or disable
them, reverting to console-only administration.
Vendor communication:
2007/01/11 - Initial notification to Aruba WSIRT
2007/01/11 - Aruba WSIRT assigns contact
2007/01/11 - n.runs provides crashdump to Aruba
2007/01/15 - Aruba provides feedback on the vulnerability
2007/01/18 - Patches available
2007/01/27 - n.runs verifies patched firmware
ADDITIONAL INFORMATION
The information has been provided by <mailto:security@nruns.com> n.runs.
The original article can be found at: <http://www.nruns.com/>
http://www.nruns.com/
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
