Aruba Mobility Controller Management Buffer Overflow

n.runs AG =20
http://www.nruns.com/ security at nruns.com
n.runs-SA-2007.002 8-Feb-2007

__________________________________________________ ______________________

Vendor: Aruba Networks, http://www.arubanetworks.com
Affected Products: Aruba Mobility Controllers 200, 600, 2400, 6000
Alcatel Alcatel-Lucent OmniAccess Wireless
43xx, 6000
Vulnerability: Aruba Mobility Controller Management Buffer Overflow

Risk: HIGH
CERT VU ID: VU#613833


Vendor communication:

2007/01/11 Initial notification to Aruba WSIRT
2007/01/11 Aruba WSIRT assigns contact
2007/01/11 n.runs provides crashdump to Aruba
2007/01/15 Aruba provides feedback on the vulnerability
2007/01/18 Patches available
2007/01/27 n.runs verifies patched firmware


Systems Affected:

All Aruba Networks Mobility Controllers (200, 800, 2400, and 6000) =
running
software versions greater than 2.0
Alcatel-Lucent OmniAccess Wireless 43xx and 6000 running software =
versions
2.0 and later.


Overview:

The Aruba Mobility Controller=92s management interfaces are susceptible =
to a
heap based buffer overflow vulnerability, =20


Description:

Both the command line based and the web based management interface of =
the
Aruba Mobility Controller are vulnerable to a heap based buffer overflow
when overly long strings are passed as credentials. This can potentially
lead to remote code execution, resulting in a system compromise.=20


Impact:

The overflow will in any case result in memory corruption that crashes =
the
management interface=92s process, leading to a Denial of Service (DoS)
condition of the remote management capabilities. A carefully crafted
overflow may result in code execution, allowing an attacker to fully =
control
the device.

Solution:

Aruba Networks has made patched firmware available to their customers, =
who
should be able to retrieve it through Aruba's support site
https://support.arubanetworks.com. As a workaround, restrict access to =
the
administrative interfaces or disable them, reverting to console-only
administration.=20



Credit: Bugs found by Jan M=FCnther and Maxim Salomon of n.runs AG.=20
Special thanks to Scott Kelly of Aruba Networks for the
quick and professional handling of this issue.=20
__________________________________________________ __________________

Unaltered electronic reproduction of this advisory is permitted. For all
other=20
reproduction or publication, in printing or otherwise, contact
security@nruns.com for permission.
Use of the advisory constitutes acceptance for use in an "as is" =
condition.=20
All warranties are excluded. In no event shall n.runs be liable
for any damages whatsoever including direct, indirect, incidental,
consequential, loss of business profits or special damages, even if =
n.runs
has been advised of the possibility of such damages.=20

Copyright 2007 n.runs AG. All rights reserved. Terms of use.