-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ADVISORY NUMBER 031912 Advisory # 1: TITLE OS Command Injection Vulnerability in Aruba Remote Access Point Diagnostic Web Interface. SUMMARY An OS command injection vulnerability has been discovered in the Aruba Remote Access Point's Diagnostic Web Interface. When running the diagnostic web interface, arbitrary system commands can be executed as the root user on the Remote device by an unauthenticated attacker. AFFECTED ArubaOS VERSIONS 5.0.x.x, 6.0.x.x, 6.1.x.x DETAILS The Remote Access Point provides a web interface to facilitate initial provisioning of the device. This web interface provides functionality to run some basic network diagnostics and enter configuration parameters necessary for successful provisioning. An OS command injection vulnerability has been discovered in this web interface where malicious user input can be injected via form elements and run arbitrary system commands on the device as root user. This diagnostic web interface can be disabled after initial provisioning of the device. IMPACT An unauthenticated attacker can run arbitrary system commands on the device as root user. This could lead to a full compromise of the device's operating system. This vulnerability applies only to the Aruba Remote Access Point and other Aruba devices are not affected. CVSS v2 BASE METRIC SCORE: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) WORKAROUNDS Aruba Networks recommends not allowing access to the Aruba Remote Access Point's diagnostic web interface after initial provisioning by applying an access list (acl) to block HTTP and HTTPS protocol to its local IP. This restricted acl needs to be in the highest position of the acl rules for each user-role that should not have access to the diagnostic web interface. Example restricted IP access list added to a user-role called guest: ip access-list session local_debug_restricted user localip svc-http deny user localip svc-https deny user-role guest access-list session local_debug_restricted access-list session dns-acl access-list session dhcp-acl access-list session icmp-acl access-list session http-acl access-list session https-acl SOLUTION Aruba Networks recommends that all customers apply the appropriate patch(es) as soon as practical. The following patches have the fix (any newer patch will also have the fix): - - - ArubaOS 5.0.4.2 - - - ArubaOS 6.0.2.1 - - - ArubaOS 6.1.2.4 CREDITS This vulnerability was discovered and reported by Greg Ose of CME GROUP. +---------------------------------------------------- Advisory # 2: TITLE 802.1X User Authentication Bypass Vulnerability when EAP-TLS 802.1X local termination is enabled on WLAN. SUMMARY An EAP-TLS 802.1X user authentication bypass vulnerability was discovered during standard internal bug reporting procedures in the Aruba Mobility Controller. This vulnerability only affects customers with EAP-TLS 802.1X local termination enabled. AFFECTED ArubaOS VERSIONS 6.1.x.x DETAILS Aruba Mobility Controllers allow for local termination of EAP-TLS 802.1X authentication of wireless users accessing the network. Local 802.1X termination allows rapid deployment of WLAN without requiring an external authentication server capable of EAP-TLS authentication. A vulnerability in the EAP-TLS 802.1X termination component in the Mobility Controller may allow unauthorized network access to some users. EAP-TLS 802.1X termination is not the default setup and must be configured manually for before it will be used. Wireless and wired users authenticating to an external authentication server are NOT vulnerable. Other WLANs and other wired ports on the same Mobility Controller that do not use local termination of 802.1X EAP-TLS are NOT affected by this vulnerability. IMPACT An EAP-TLS 802.1X user may be able to gain unauthorized access to a WLAN or a wired port configured with local 802.1X termination of EAP-TLS authentications on the Aruba Mobility Controller. CVSS v2 BASE METRIC SCORE: 6.1 (AV:A/AC:L/AU:N/C:C/I:N/A:N) HOW TO IDENTIFY IF YOU ARE VULNERABLE If the following lines exist in your configuration for a particular aaa profile and that profile is assigned to an active virtual ap or wired port, then you are vulnerable. aaa authentication dot1x termination enable termination eap-type eap-tls ... ... ! WORKAROUNDS Aruba Networks recommends that all customers apply the appropriate patch(es) as soon as practical. However, in the event that a patch cannot immediately be applied, the following steps will help to mitigate the risk: - - - Disable EAP-TLS 802.1X local termination for wireless and wired users until such time as the patches can be applied and switch to using an external EAP-TLS server for authenticating wireless users. If local 802.1X termination cannot be disabled, switch to using another EAP method to authenticate wireless and wired users. SOLUTION Aruba Networks recommends that all customers apply the appropriate patch(es) as soon as practical. The following patches have the fix (any newer patch will also have the fix): - - - ArubaOS 6.1.2.6 +---------------------------------------------------- OBTAINING FIXED FIRMWARE Aruba customers can obtain the firmware on the support website: http://www.arubanetworks.com/support Aruba Support contacts are as follows: 1-800-WiFiLAN (1-800-943-4526) (toll free from within North America) +1-408-754-1200 (toll call from anywhere in the world) The full contact list is at: http://www.arubanetworks.com/support-services/aruba-support-program/contact-support/ e-mail: support(at)arubanetworks.com Please, do not contact either "wsirt(at)arubanetworks.com" or "security(at)arubanetworks.com" for software upgrades. EXPLOITATION AND PUBLIC ANNOUNCEMENTS This vulnerability will be announced at Aruba W.S.I.R.T. Advisory: http://www.arubanetworks.com/support/alerts/aid-031912.asc SecurityFocus Bugtraq http://www.securityfocus.com/archive/1 STATUS OF THIS NOTICE: Final Although Aruba Networks cannot guarantee the accuracy of all statements in this advisory, all of the facts have been checked to the best of our ability. Aruba Networks does not anticipate issuing updated versions of this advisory unless there is some material change in the facts. Should there be a significant change in the facts, Aruba Networks may update this advisory. A stand-alone copy or paraphrase of the text of this security advisory that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors. DISTRIBUTION OF THIS ANNOUNCEMENT This advisory will be posted on Aruba's website at: http://www.arubanetworks.com/support/alerts/aid-031912.asc Future updates of this advisory, if any, will be placed on Aruba's worldwide website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates. REVISION HISTORY Revision 1.0 / 03-19-2012 / Initial release ARUBA WSIRT SECURITY PROCEDURES Complete information on reporting security vulnerabilities in Aruba Networks products, obtaining assistance with security incidents is available at http://www.arubanetworks.com/support-services/security-bulletins/ For reporting *NEW* Aruba Networks security issues, email can be sent to wsirt(at)arubanetworks.com or security(at)arubanetworks.com. For sensitive information we encourage the use of PGP encryption. Our public keys can be found at http://www.arubanetworks.com/support-services/security-bulletins/ (c) Copyright 2012 by Aruba Networks, Inc. This advisory may be redistributed freely after the release date given at the top of the text, provided that redistributed copies are complete and unmodified, including all date and version information. -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.17 (Darwin) Comment: GPGTools - http://gpgtools.org iEYEARECAAYFAk9ncO0ACgkQp6KijA4qefVjDgCg8HZMeUnEYSBuSiRndOH3Y/5u +RAAoIigvSP8t8cTCLVCQATl3CXnHWFc =pXB1 -----END PGP SIGNATURE-----