[NEWS] Aruba Mobility Controller Management Buffer Overflow
- From: SecuriTeam <support@xxxxxxxxxxxxxx>
- Date: 13 Feb 2007 11:59:10 +0200
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Aruba Mobility Controller Management Buffer Overflow
------------------------------------------------------------------------
SUMMARY
The Aruba Mobility Controller s management interfaces are susceptible to a
heap based buffer overflow vulnerability.
DETAILS
Systems Affected:
* All Aruba Networks Mobility Controllers (200, 800, 2400, and 6000)
running software versions greater than 2.0 Alcatel-Lucent OmniAccess
Wireless 43xx and 6000 running software versions 2.0 and later.
Details:
Both the command line based and the web based management interface of the
Aruba Mobility Controller are vulnerable to a heap based buffer overflow
when overly long strings are passed as credentials. This can potentially
lead to remote code execution, resulting in a system compromise.
Impact:
The overflow will in any case result in memory corruption that crashes the
management interface s process, leading to a Denial of Service (DoS)
condition of the remote management capabilities. A carefully crafted
overflow may result in code execution, allowing an attacker to fully
control the device.
Solution:
Aruba Networks has made patched firmware available to their customers, who
should be able to retrieve it through Aruba's support site
<https://support.arubanetworks.com> https://support.arubanetworks.com. As
a workaround, restrict access to the administrative interfaces or disable
them, reverting to console-only administration.
Vendor communication:
2007/01/11 - Initial notification to Aruba WSIRT
2007/01/11 - Aruba WSIRT assigns contact
2007/01/11 - n.runs provides crashdump to Aruba
2007/01/15 - Aruba provides feedback on the vulnerability
2007/01/18 - Patches available
2007/01/27 - n.runs verifies patched firmware
ADDITIONAL INFORMATION
The information has been provided by <mailto:security@xxxxxxxxx> n.runs.
The original article can be found at: <http://www.nruns.com/>
http://www.nruns.com/
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
- Prev by Date: [NEWS] Aruba Networks Unauthorized Administrative and WLAN Access through Guest Account
- Next by Date: [NEWS] HP Mercury LoadRunner Agent Stack Overflow
- Previous by thread: [NEWS] Aruba Networks Unauthorized Administrative and WLAN Access through Guest Account
- Next by thread: [NEWS] HP Mercury LoadRunner Agent Stack Overflow
- Index(es):
Relevant Pages
- [NT] Lhaplus LHA Extended Header Handling Buffer Overflow
... The following security advisory is sent to the securiteam mailing list, and can be
found at the SecuriTeam web site: http://www.securiteam.com ... Lhaplus LHA Extended Header
Handling Buffer Overflow ... A vulnerability has been found in Lhaplus. ...
This advisory discloses a buffer overflow vulnerability in Lhaplus. ... (Securiteam) - [NEWS] 0verkill Buffer Overflow Vulnerabilities
... The following security advisory is sent to the securiteam mailing list, and can be
found at the SecuriTeam web site: http://www.securiteam.com ... $HOME environment variable demonstrates
the buffer overflow, ... GNU gdb 5.0 ... vulnerability or to otherwise
crash the program. ... (Securiteam) - [EXPL] Microsoft Windows XVoice.dll and Xlisten.dll Buffer Overflow (Exploit)
... The following security advisory is sent to the securiteam mailing list, and can be
found at the SecuriTeam web site: http://www.securiteam.com ... An exploitable buffer overflow
in Microsoft Windows' DirectSpeechSynthesis ... arbitrary code by overflowing the ModeName
parameter of the ActiveX. ... Microsoft Windows DirectSpeechSynthesis Module ...
(Securiteam) - [NT] CA ARCServe Backup for Laptops and Desktops Multiple Buffer Overflow Vulnerabilities
... The following security advisory is sent to the securiteam mailing list, and can be
found at the SecuriTeam web site: http://www.securiteam.com ... CA ARCServe Backup for Laptops
and Desktops Multiple Buffer Overflow ... Remote exploitation of multiple buffer overflow
vulnerabilities in ... rxsGetSubDirs, rxsGetServerDBPathName, rxsSetServerOptions,
rxsDeleteFile, ... (Securiteam) - [NT] DynaZip DZIP32.DLL/DZIPS32.DLL Buffer Overflow Vulnerabilities
... The following security advisory is sent to the securiteam mailing list, and can be
found at the SecuriTeam web site: http://www.securiteam.com ... DynaZip DZIP32.DLL/DZIPS32.DLL
Buffer Overflow Vulnerabilities ... This advisory discloses some buffer overflow vulnerabilities
in DynaZip ... DWORD var1; ... (Securiteam)
