VU#613833 Mobility Controller Management buffer overflow Advisory
n.runs AG
http://www.nruns.com
n.runs-SA-2007.002
security(at)nruns.com
08-Feb-2007
* * *
Vendor: Aruba Networks, http://www.arubanetworks.com
Affected Products: Aruba Mobility Controllers 200, 600, 2400, 6000
Alcatel Alcatel-Lucent OmniAccess Wireless 43xx, 6000
Vulnerability: Aruba Mobility Controller Management Buffer Overflow
Risk:HIGH
CERT VU ID:VU#613833
Vendor communication:
2007/01/11 Initial notification to Aruba WSIRT
2007/01/11 Aruba WSIRT assigns contact
2007/01/11 n.runs provides crashdump to Aruba
2007/01/15 Aruba provides feedback on the vulnerability
2007/01/18 Patches available.
2007/01/27 .runs verifies patched firmware
Systems Affected:
All Aruba Networks Mobility Controllers (200, 800, 2400, and 6000) running software versions greater than 2.0 Alcatel-Lucent OmniAccess Wireless 43xx and 6000 running software versions 2.0 and later.
Overview:
The Aruba Mobility Controller’s management interfaces are susceptible to a heap based buffer overflow vulnerability
Description:
Both the command line based and the web based management interface of the Aruba Mobility Controller are vulnerable to a heap based buffer overflow when overly long strings are passed as credentials. This can potentially lead to remote code execution, resulting in a system compromise.
Impact:
The overflow will in any case result in memory corruption that crashes the management interface’s process, leading to a Denial of Service (DoS) condition of the remote management capabilities.
A carefully crafted overflow may result in code execution, allowing an attacker to fully control the device.
Solution:
Aruba Networks has made patched firmware available to their customers, who should be able to retrieve it through Aruba's support site https://support.arubanetworks.com
As a workaround, restrict access to the administrative interfaces or disable them, reverting to console-only administration.
Credit:
Bugs found by Jan Münther and Maxim Salomon of n.runs AG.
Special thanks to Scott Kelly of Aruba Networks for the quick and professional handling of this issue.
Unaltered electronic reproduction of this advisory is permitted.
For all other reproduction or publication, in printing or otherwise, contact security@nruns.com for permission.
Use of the advisory constitutes acceptance for use in an "as is" condition.
All warranties are excluded. In no event shall n.runs be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if n.runs has been advised of the possibility of such damages.
Copyright 2007 n.runs AG. All rights reserved. Terms of use. |
