Aruba Networks - Unauthorized Administrative and WLAN Access through Guest Account



n.runs AG
http://www.nruns.com/ security at nruns.com
n.runs-SA-2007.001 8-Feb-2007

________________________________________________________________________


Vendor: Aruba Networks, http://www.arubanetworks.com
Affected Products: Aruba Mobility Controllers 200, 600, 2400, 6000
Alcatel-Lucent OmniAccess Wireless 43xx and
6000
Vulnerability: Unauthorized Administrative and WLAN Access through
Guest Account
Risk: HIGH
CERT VU ID: VU#319913


Vendor communication:

2007/01/11 Initial notification to Aruba WSIRT
2007/01/11 Aruba WSIRT assigns contact
2007/01/15 Aruba provides feedback on the
vulnerability.
2007/01/18 Patches available
2007/01/28 n.runs verifies patched firmware


Systems Affected:

All Aruba Networks Mobility Controllers (200, 800, 2400, and 6000) running
software versions greater than 2.0
Alcatel-Lucent OmniAccess Wireless 43xx and 6000 running software versions
2.0 and later.


Overview:

A flaw in an authorization component allows for unauthorized access to the
Wireless LAN through a Captive Portal, VPN, and administrative access using
either the web-based administration or the command line interface.
This vulnerability affects all versions of the Aruba Controller beginning
with version 2.3.


Description:

To provide access to guest users on the Captive Portal, a built-in guest
account exists in the aforementioned firmware releases.
An implementation error has lead to a flaw which allows anyone in possession
of this account?s logon name to authenticate to the administrative
interfaces or the WLAN without specifying a password.


Impact:

If the management interfaces are reachable, an attacker can gain full
control over the device through this account.
Likewise, an attacker may gain unauthorized access to the WLAN, if no other
security safeguards such as WPA-PSK are in place.
If WLAN access control is enforced through VPN client authentication, a
compromise of the WLAN is possible if the attacker can provide the group key
for the VPN.


Solution:

Aruba Networks has made patched firmware available to their customers, who
should be able to retrieve it through Aruba's support site
https://support.arubanetworks.com. As a workaround, restrict access to the
administrative interfaces or disable them, reverting to console-only
administration.
Disable the Captive Portal.
Require MSCHAPv2 for VPN authentication.



Credit: Bugs found by Jan Münther and Maxim Salomon of n.runs AG.
Special thanks to Scott Kelly of Aruba Networks for the
quick and professional handling of this issue.

____________________________________________________________________

Unaltered electronic reproduction of this advisory is permitted. For all
other
reproduction or publication, in printing or otherwise, contact
security@xxxxxxxxx for permission.
Use of the advisory constitutes acceptance for use in an "as is" condition.
All warranties are excluded. In no event shall n.runs be liable
for any damages whatsoever including direct, indirect, incidental,
consequential, loss of business profits or special damages, even if n.runs
has been advised of the possibility of such damages.

Copyright 2007 n.runs AG. All rights reserved. Terms of use.



Relevant Pages

  • [Full-disclosure] Aruba Networks - Unauthorized Administrative and WLAN Access through Guest
    ... Alcatel-Lucent OmniAccess Wireless 43xx and 6000 running software versions ... either the web-based administration or the command line interface. ... To provide access to guest users on the Captive Portal, ... account exists in the aforementioned firmware releases. ...
    (Full-Disclosure)
  • OT I never do this ...
    ... THE APPARENT confusion within the Obama administration about whether to prosecute officials of the previous administration for committing torture is not surprising. ... What if the next administration believes that Barack Obama is committing war crimes every time he allows the Air Force to fling missiles into Pakistan, killing innocent civilians in a country with which we are not at war? ... Neither will happen if public service routinely is followed by the need to hire private attorneys and empty one's bank account. ... Congress or the president can opt for amnesty. ...
    (rec.outdoors.fishing.fly)
  • Re: Help with Guest account
    ... Account and created a new User Account. ... Same thing in the Guest ... problem accessing the internet with it as it uses that same network ... enable the Guest Account is "an" administrator account. ...
    (microsoft.public.windowsxp.security_admin)
  • RE: Bypass Traverse Checking?
    ... Authenticated Users, because they are significantly different (different ... account without that SID in its token would not be able to access the ... you are affecting Anonymous Logon and the _builtin_ Guest ... account. ...
    (Focus-Microsoft)
  • Re: Office 2004 Mainstream Support Has Been Extended two years!
    ... Further research indicates that it affects systems where the the Guest ... Phillip: I should have done a bit more research :-) ... concept of a "Guest" account. ... John McGhie, Microsoft MVP, Consultant Technical ...
    (microsoft.public.mac.office.word)