-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------


      Aruba Wireless Networks Security Advisory

Title: SSH vulnerabilities
Aruba Advisory ID: AID-11182003
Revision: 1.0
For Public Release on 11/18/2003 at 19:00 (GMT)
References: CERT Vulnerability Note VU#333628
            


- ------------------------------------------------------------------------

SUMMARY

Versions of the OpenSSH server prior to 3.7.1 contain buffer management
errors.  Although the real impact of these vulnerabilities are unclear,
they may lead to memory corruption and a possible denial-of-service
situation.


PRODUCTS AND FIRMWARE VERSIONS AFFECTED

Hardware: All Aruba Wireless Networks switch platforms (800 and 5000)
are affected.
Software: All Aruba AirOS versions are vulnerable.


DETAILS

The SSH code contain errors in the general handling of buffers.  In this
case, it is caused by a large amount of memory being cleared, this is an
issue with freeing the appropriate memory size on the heap. 


IMPACT

Memory corruption and possible crash.

WORKAROUNDS

Allow access only from trusted devices using access control lists.




SOLUTION

Fixes in software are required. All previous and newer versions of
released software have a patch available.  Note that the patch does not
update the OpenSSH version number itself, but all security patches have
been applied.


OBTAINING FIXED FIRMWARES

The following AirOS versions contain fixes for this issue.

1.1_4312 and later (built 11/18/2003)
2.0_4310 and later (built 11/18/2003)
All new code releases after 11/18/2003

   
   Aruba Support contacts are as follows:

     1-800-WiFiLAN (1-800-943-4526) (toll free from within North
     America)
     +1-408-754-1200 (toll call from anywhere in the world)
     e-mail: support(at)arubanetworks.com
     web: http://www.arubanetworks.com/support

   Please, do not contact either "wsirt(at)arubanetworks.com" or 
"security(at)arubanetworks.com" for software upgrades.


EXPLOITATION AND PUBLIC ANNOUNCEMENTS

	This vulnerability will be announced at 
	http://www.kb.cert.org/vuls


STATUS OF THIS NOTICE: Final

Although Aruba Wireless networks cannot guarantee the accuracy of all
statements in this advisory, all of the facts have been checked to the
best of our ability. Aruba Wireless Networks does not anticipate issuing
updated versions of this advisory unless there is some material change
in the facts. Should there be a significant change in the facts, Aruba
Wireless Networks may update this advisory.

A stand-alone copy or paraphrase of the text of this security advisory
that omits the distribution URL in the following section is an
uncontrolled copy, and may lack important information or contain factual
errors.

DISTRIBUTION OF THIS ANNOUCEMENT

      This advisory will be posted on Aruba's website at
     
http://www.arubanetworks.com/support/wsirt/alerts/AID-11182003.asc


Future updates of this advisory, if any, will be placed on Aruba's
worldwide website, but may or may not be actively announced on mailing
lists or newsgroups. Users concerned about this problem are encouraged
to check the above URL for any updates.

REVISION HISTORY


      Revision 1.0 /11-18-2003 / Initial release


ARUBA WSIRT SECURITY PROCEDURES

Complete information on reporting security vulnerabilities in Aruba
Wireless Networks products, obtaining assistance with security incidents
is available at http://www.arubanetworks.com/support/wsirt.php
   
  
For reporting *NEW* Aruba Wireless Networks security issues, email can
be sent to wsirt(at)arubanetworks.com or security(at)arubanetworks.com.
For sensitive information we encourage the use of PGP encryption. Our
public keys can be found at
http://www.arubanetworks.com/support/wsirt.php


      (c) Copyright 2003 by Aruba Wireless Networks, Inc.
This advisory may be redistributed freely after the release date given
at the top of the text, provided that redistributed copies are complete
and unmodified, including all date and version information.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFGeFn+p6KijA4qefURAiBsAJ9MVv74TJfnLSg0VELTohEotRoPFgCgtRp2
3b9z691ZfRi8+hNZJrWaNVM=
=0okD
-----END PGP SIGNATURE-----