[NEWS] Aruba Networks Unauthorized Administrative and WLAN Access through Guest Account

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



Aruba Networks Unauthorized Administrative and WLAN Access through Guest
Account
------------------------------------------------------------------------


SUMMARY

A flaw in an authorization component allows for unauthorized access to the
Wireless LAN through a Captive Portal, VPN, and administrative access
using either the web-based administration or the command line interface.
This vulnerability affects all versions of the Aruba Controller beginning
with version 2.3.

DETAILS

Systems Affected:
* All Aruba Networks Mobility Controllers (200, 800, 2400, and 6000)
running software versions greater than 2.0 Alcatel-Lucent OmniAccess
Wireless 43xx and 6000 running software versions 2.0 and later.

Impact:
If the management interfaces are reachable, an attacker can gain full
control over the device through this account. Likewise, an attacker may
gain unauthorized access to the WLAN, if no other security safeguards such
as WPA-PSK are in place. If WLAN access control is enforced through VPN
client authentication, a compromise of the WLAN is possible if the
attacker can provide the group key for the VPN.

Solution:
Aruba Networks has made patched firmware available to their customers, who
should be able to retrieve it through Aruba's support site
<https://support.arubanetworks.com> https://support.arubanetworks.com. As
a workaround, restrict access to the administrative interfaces or disable
them, reverting to console-only administration.

* Disable the Captive Portal.

* Require MSCHAPv2 for VPN authentication.

Vendor communication:
2007/01/11 - Initial notification to Aruba WSIRT
2007/01/11 - Aruba WSIRT assigns contact
2007/01/15 - Aruba provides feedback on the vulnerability.
2007/01/18 - Patches available
2007/01/28 - n.runs verifies patched firmware


ADDITIONAL INFORMATION

The information has been provided by <mailto:security@xxxxxxxxx> n.runs.
The original article can be found at: <http://www.nruns.com/>
http://www.nruns.com/



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages

  • [NEWS] Cisco Call Manager Privilege Escalation
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Cisco CallManager is "the software-based call-processing component ... administrative privileges and create, delete, or reset devices. ... Complete this procedure to check if Multi Level Administration is enabled: ...
    (Securiteam)
  • [NT] SafeNet SoftRemote VPN Client Clear-text Password in Memory
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... SoftRemote VPN client: The SoftRemote client stores the password in an ... The SafeNet SoftRemote VPN client is widely used for remote access IPsec ... system to obtain a physical memory dump. ...
    (Securiteam)
  • [NEWS] Findnot.com VPN Service Address Privacy Breach and Unencrypted Data
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Findnot.com VPN Service Address Privacy Breach and Unencrypted Data ... Exposing your REAL IP address during Internet ... a disconnection with the remote VPN server. ...
    (Securiteam)
  • [NT] Computer Associates eTrust Intrusion Detection DoS Vulnerability
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Computer Associates eTrust Intrusion Detection DoS Vulnerability ... Since the administration server fails to properly validate the key length ...
    (Securiteam)
  • [NEWS] Neteyes Nexusways Weak Authentication, Shell Escaping and Command Execution
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Neteyes Nexusway may use this vulnerability to become Neteyes Nexusway ... argument in certain command. ... Disable web based administration module. ...
    (Securiteam)