n.runs AG =20
http://www.nruns.com/ security at nruns.com
n.runs-SA-2007.001 8-Feb-2007

__________________________________________________ ______________________


Vendor: Aruba Networks, http://www.arubanetworks.com
Affected Products: Aruba Mobility Controllers 200, 600, 2400, 6000
Alcatel-Lucent OmniAccess Wireless 43xx and
6000
Vulnerability: Unauthorized Administrative and WLAN Access through
Guest Account=20
Risk: HIGH
CERT VU ID: VU#319913


Vendor communication:

2007/01/11 Initial notification to Aruba WSIRT
2007/01/11 Aruba WSIRT assigns contact
2007/01/15 Aruba provides feedback on the
vulnerability.
2007/01/18 Patches available
2007/01/28 n.runs verifies patched firmware


Systems Affected:

All Aruba Networks Mobility Controllers (200, 800, 2400, and 6000) =
running
software versions greater than 2.0
Alcatel-Lucent OmniAccess Wireless 43xx and 6000 running software =
versions
2.0 and later.


Overview:

A flaw in an authorization component allows for unauthorized access to =
the
Wireless LAN through a Captive Portal, VPN, and administrative access =
using
either the web-based administration or the command line interface.=20
This vulnerability affects all versions of the Aruba Controller =
beginning
with version 2.3.=20


Description:

To provide access to guest users on the Captive Portal, a built-in guest
account exists in the aforementioned firmware releases.=20
An implementation error has lead to a flaw which allows anyone in =
possession
of this account=92s logon name to authenticate to the administrative
interfaces or the WLAN without specifying a password.=20


Impact:

If the management interfaces are reachable, an attacker can gain full
control over the device through this account.=20
Likewise, an attacker may gain unauthorized access to the WLAN, if no =
other
security safeguards such as WPA-PSK are in place.=20
If WLAN access control is enforced through VPN client authentication, a
compromise of the WLAN is possible if the attacker can provide the group =
key
for the VPN.=20


Solution:

Aruba Networks has made patched firmware available to their customers, =
who
should be able to retrieve it through Aruba's support site
https://support.arubanetworks.com. As a workaround, restrict access to =
the
administrative interfaces or disable them, reverting to console-only
administration.=20
Disable the Captive Portal.=20
Require MSCHAPv2 for VPN authentication.=20



Credit: Bugs found by Jan M=FCnther and Maxim Salomon of n.runs AG.=20
Special thanks to Scott Kelly of Aruba Networks for the
quick and professional handling of this issue.=20

__________________________________________________ __________________

Unaltered electronic reproduction of this advisory is permitted. For all
other=20
reproduction or publication, in printing or otherwise, contact
security@nruns.com for permission.
Use of the advisory constitutes acceptance for use in an "as is" =
condition.=20
All warranties are excluded. In no event shall n.runs be liable
for any damages whatsoever including direct, indirect, incidental,
consequential, loss of business profits or special damages, even if =
n.runs
has been advised of the possibility of such damages.=20

Copyright 2007 n.runs AG. All rights reserved. Terms of use.