-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Aruba Networks Security Advisory

Title: Aruba Mobility Controller Management Interface Session Cookie Vulnerability
Aruba Advisory ID: AID-090407
Revision: 1.0

For Public Release on 09/04/2007

References:	
	US-CERT Advisory VU#782265

+----------------------------------------------------


SUMMARY

A session cookie vulnerability was discovered during an internal audit of the Aruba
Mobility Controller.  This vulnerability affects customers using software versions below
2.5.5.2, 2.5.4.24, 2.5.2.10, 2.3.6.14, and all 2.4.8.x-FIPS builds.


DETAILS

A weakness in management session cookie construction was discovered during an internal
security audit of the Aruba Mobility Controller. An attacker with network access to 
the management UI may be able to gain unauthorized access to the administration account
of an Aruba Mobility Controller.


IMPACT

An attacker may be able to generate session keys valid on remote Mobility controllers,
giving administrative access to the web-based management system.


CVSS BASE METRIC SCORE: 9


WORKAROUNDS

See Solution below.


SOLUTION

Aruba Networks recommends that all customers apply the appropriate patche(es) as soon
as practical.  However, in the event that a patch cannot immediately be applied, the
following steps will help to mitigate the risk:

 - Do not expose the Mobility Controller administrative interface to untrusted networks
such as the Internet.

 - For customers using 2.4.8.x-FIPS builds please review the FAQ on the Support Site in 
the Support Bulletins folder titled as "FIPS Build FAQ For Web Management Interface 
Session Vulnerability".


OBTAINING FIXED FIRMWARES

Aruba customers can obtain the firmware on the support website:
	http://www.arubanetworks.com/support. 
   
Aruba Support contacts are as follows:

	1-800-WiFiLAN (1-800-943-4526) (toll free from within North
	America)

	+1-408-754-1200 (toll call from anywhere in the world)

	e-mail: support(at)arubanetworks.com

Please, do not contact either "wsirt(at)arubanetworks.com" or 
"security(at)arubanetworks.com" for software upgrades.


EXPLOITATION AND PUBLIC ANNOUNCEMENTS

This vulnerability will be announced at 

Aruba W.S.I.R.T. Advisory:
http://www.arubanetworks.com/support/wsirt/alerts/aid-090407.asc

US-CERT Advisory:
http://www.kb.cert.org/vuls/id/782265


STATUS OF THIS NOTICE: Final

Although Aruba Networks cannot guarantee the accuracy of all statements in this 
advisory, all of the facts have been checked to the best of our ability. Aruba
Networks does not anticipate issuing updated versions of this advisory unless there
is some material change in the facts. Should there be a significant change in the
facts, Aruba Networks may update this advisory.

A stand-alone copy or paraphrase of the text of this security advisory that omits
the distribution URL in the following section is an uncontrolled copy, and may
lack important information or contain factual errors.


DISTRIBUTION OF THIS ANNOUNCEMENT

This advisory will be posted on Aruba's website at:
http://www.arubanetworks.com/support/alerts/aid-090407.asc


Future updates of this advisory, if any, will be placed on Aruba's worldwide website, 
but may or may not be actively announced on mailing lists or newsgroups. Users 
concerned about this problem are encouraged to check the above URL for any updates.


REVISION HISTORY

      Revision 1.0 / 09-04-2007 / Initial release


ARUBA WSIRT SECURITY PROCEDURES

Complete information on reporting security vulnerabilities in Aruba 
Wireless Networks products, obtaining assistance with security incidents is available at
      http://www.arubanetworks.com/support/wsirt.php
   
  
For reporting *NEW* Aruba Networks security issues, email can be sent to 
wsirt(at)arubanetworks.com or security(at)arubanetworks.com. For sensitive information
we encourage the use of PGP encryption. Our public keys can be found at 
	http://www.arubanetworks.com/support/wsirt.php


      (c) Copyright 2007 by Aruba Networks, Inc.
This advisory may be redistributed freely after the release date given at the top of
the text, provided that redistributed copies are complete and unmodified, including all
date and version information.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFG5hXUp6KijA4qefURAtkQAJ9yyUBIZkZV0fWjZIn8AeEE/1FW5wCgx/6y
1+ti15KWcZLoBx4+RoCXX4o=
=Q8Gx
-----END PGP SIGNATURE-----