exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

n.runs-SA-2007.002.txt

n.runs-SA-2007.002.txt
Posted Feb 14, 2007
Site nruns.com

Both the command line based and the web based management interface of the Aruba Mobility Controller are vulnerable to a heap based buffer overflow when overly long strings are passed as credentials. This can potentially lead to remote code execution, resulting in a system compromise.

tags | advisory, remote, web, overflow, code execution
SHA-256 | 2765a8733591e6cc8a10571d0eddc6946cf3800a1474c9f2a49ef8364eeb7b9e

n.runs-SA-2007.002.txt

Change Mirror Download
n.runs AG             
http://www.nruns.com/ security at nruns.com
n.runs-SA-2007.002 8-Feb-2007

________________________________________________________________________

Vendor: Aruba Networks, http://www.arubanetworks.com
Affected Products: Aruba Mobility Controllers 200, 600, 2400, 6000
Alcatel Alcatel-Lucent OmniAccess Wireless
43xx, 6000
Vulnerability: Aruba Mobility Controller Management Buffer Overflow

Risk: HIGH
CERT VU ID: VU#613833


Vendor communication:

2007/01/11 Initial notification to Aruba WSIRT
2007/01/11 Aruba WSIRT assigns contact
2007/01/11 n.runs provides crashdump to Aruba
2007/01/15 Aruba provides feedback on the vulnerability
2007/01/18 Patches available
2007/01/27 n.runs verifies patched firmware


Systems Affected:

All Aruba Networks Mobility Controllers (200, 800, 2400, and 6000) running
software versions greater than 2.0
Alcatel-Lucent OmniAccess Wireless 43xx and 6000 running software versions
2.0 and later.


Overview:

The Aruba Mobility Controller’s management interfaces are susceptible to a
heap based buffer overflow vulnerability,


Description:

Both the command line based and the web based management interface of the
Aruba Mobility Controller are vulnerable to a heap based buffer overflow
when overly long strings are passed as credentials. This can potentially
lead to remote code execution, resulting in a system compromise.


Impact:

The overflow will in any case result in memory corruption that crashes the
management interface’s process, leading to a Denial of Service (DoS)
condition of the remote management capabilities. A carefully crafted
overflow may result in code execution, allowing an attacker to fully control
the device.

Solution:

Aruba Networks has made patched firmware available to their customers, who
should be able to retrieve it through Aruba's support site
https://support.arubanetworks.com. As a workaround, restrict access to the
administrative interfaces or disable them, reverting to console-only
administration.



Credit: Bugs found by Jan M√ľnther and Maxim Salomon of n.runs AG.
Special thanks to Scott Kelly of Aruba Networks for the
quick and professional handling of this issue.
____________________________________________________________________

Unaltered electronic reproduction of this advisory is permitted. For all
other
reproduction or publication, in printing or otherwise, contact
security@nruns.com for permission.
Use of the advisory constitutes acceptance for use in an "as is" condition.
All warranties are excluded. In no event shall n.runs be liable
for any damages whatsoever including direct, indirect, incidental,
consequential, loss of business profits or special damages, even if n.runs
has been advised of the possibility of such damages.

Copyright 2007 n.runs AG. All rights reserved. Terms of use.

Login or Register to add favorites

File Archive:

December 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Dec 1st
    11 Files
  • 2
    Dec 2nd
    0 Files
  • 3
    Dec 3rd
    0 Files
  • 4
    Dec 4th
    32 Files
  • 5
    Dec 5th
    0 Files
  • 6
    Dec 6th
    0 Files
  • 7
    Dec 7th
    0 Files
  • 8
    Dec 8th
    0 Files
  • 9
    Dec 9th
    0 Files
  • 10
    Dec 10th
    0 Files
  • 11
    Dec 11th
    0 Files
  • 12
    Dec 12th
    0 Files
  • 13
    Dec 13th
    0 Files
  • 14
    Dec 14th
    0 Files
  • 15
    Dec 15th
    0 Files
  • 16
    Dec 16th
    0 Files
  • 17
    Dec 17th
    0 Files
  • 18
    Dec 18th
    0 Files
  • 19
    Dec 19th
    0 Files
  • 20
    Dec 20th
    0 Files
  • 21
    Dec 21st
    0 Files
  • 22
    Dec 22nd
    0 Files
  • 23
    Dec 23rd
    0 Files
  • 24
    Dec 24th
    0 Files
  • 25
    Dec 25th
    0 Files
  • 26
    Dec 26th
    0 Files
  • 27
    Dec 27th
    0 Files
  • 28
    Dec 28th
    0 Files
  • 29
    Dec 29th
    0 Files
  • 30
    Dec 30th
    0 Files
  • 31
    Dec 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close