-----开始PGP签名消息-----哈希：SHA256 Aruba产品安全咨询===============================咨询ID：Aruba-PSA-2016-003 CVE：CVE-2016-2118出版日期：2016-APR-22状态：确认修订版：1标题===== SAMR和LSA在中间攻击中的人（“Badlock“）概述========在4.2.11，4.3.8之前的4.2.11,4.3.x之前的Samba 3.x和4.x中的MS-SAMR和MS-LSAD协议实现。4.4之前4.4.x。2 Mishandle DCERPC连接，允许中间人攻击者通过修改客户端 - 服务器数据流AKA“Badlock”来执行协议降级攻击和模拟用户。受影响的产品================= - 清除策略管理器（所有版本）未受影响的产品=================== -- Arubaos（所有版本） - AirWave（所有版本） - Aruba Instant - Aruba Via - Aruba Cloud Products（激活，中央） - 移动接入开关详细信息=======一个公开宣布的漏洞Samba可以允许攻击者禁止删除策略管理器服务器和Windows Active Directory Server之间的流量（中间中的人），以获取对安全客户管理器数据库的读/写访问，从而显示所有密码和其他潜在敏感信息。分辨率========== lexpass 6.4.7，6.5.5和6.6.0的修补程序补丁已被可用于解决此问题。请使用下面列出的任何方法来安装补丁。使用软件更新在线安装补丁：1。打开Clearpass策略管理器并转到管理>代理和软件更新>软件更新。 2. In the Firmware and Patch Updates area, find the 'ClearPass 6.x.x Hotfix Patch for CVE-2016-2118' patch and click the Download button in its row. 3. Click Install. 4. When the installation is complete and the status is shown as Needs Restart, proceed to restart ClearPass. After reboot, the status for the patch will be shown as Installed. The ClearPass Policy Manager version number will not change. Installing the Patch Offline Using the Patch File from support.arubanetworks.com and HTTP: 1. Download the 'ClearPass 6.x.x Hotfix Patch for CVE-2016-2118' patch (6.x.x will actually be 6.4.7, 6.5.5 or 6.6.0 depending on your installation) from the Support site. 2. Post the patch file to a local HTTP server. 3. Open an SSH session to the ClearPass appliance using the 'appadmin' account. 4. Type 'system update -i '5.安装完成后，问题“系统重新启动”。重新启动后，修补程序的状态将显示为已安装。Quallpass策略管理器版本号不会更改。Installing the Patch Offline Using the Patch File from support.arubanetworks.com and SCP: 1. Download the 'ClearPass 6.x.x Hotfix Patch for CVE-2016-2118' patch (6.x.x will actually be 6.4.7, 6.5.5 or 6.6.0 depending on your installation) from the Support site. 2. Post the patch file to a local SCP server. 3. Open an SSH session to the ClearPass appliance using the 'appadmin' account. 4. Type 'system update -i < user@ '5.安装完成后，问题“系统重新启动”。重新启动后，修补程序的状态将显示为已安装。Quallpass策略管理器版本号不会更改。Installing the Patch Offline Using the Patch File from support.arubanetworks.com: 1. Download the 'ClearPass 6.x.x Hotfix Patch for CVE-2016-2118' patch (6.x.x will actually be 6.4.7, 6.5.5 or 6.6.0 depending on your installation) from the Support site. 2. Open the ClearPass Policy Manager Admin UI and go to Administration > Agents and Software Updates > Software Updates. 3. At the bottom of the Firmware and Patch Updates area, click Import Updates and browse to the downloaded patch file. 4. Click Install. 5. When the installation is complete and the status is shown as Needs Restart, proceed to restart ClearPass. After reboot, the status for the patch will be shown as Installed. The ClearPass Policy Manager version number will not change. Revision History ================ Revision 1 / 2016-Apr-22 / Initial release Aruba SIRT Security Procedures ============================== Complete information on reporting security vulnerabilities in Aruba Networks products, obtaining assistance with security incidents is available at: //www.nexbus-cng.com/support-services/security-bulletins/ For reporting *NEW* Aruba Networks security issues, email can be sent to sirt(at)arubanetworks.com. For sensitive information we encourage the use of PGP encryption. Our public keys can be found at: //www.nexbus-cng.com/support-services/security-bulletins/ (c) Copyright 2016 by Aruba, a Hewlett Packard Enterprise company This advisory may be redistributed freely after the release date given at the top of the text, provided that redistributed copies are complete and unmodified, including all date and version information. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQEcBAEBCAAGBQJXGpvCAAoJEJj+CcpFhYbZpccH/2bXFGgI9sNpSV+8jZQNDyrf 9T/FZ9B2AeEUu5n1+S6+20srm2awAfo1L6VW5vCVLIDoOhOuqgHkY4EHH/B/a8Bc ICpnD2IXxyw9eBVy1oeQ6LiFRScSpn5DBz2A1LSn2SBtD0uWKtQj3A1/ZY2Qq8pP dmp/FxjjRW+HgDQFgq7K+M70hPbYxLMIyEb04mivp8qFvDBtucOL/9d4+NOixpL0 KuHThvGmHAlPphQcUlVh1OXtPKKl/YaNvYxG7QYEeTBmzHkub4g7flCc90fnBvRA UNKhyly8gj9ovJjYzjb+OlkP5y0a/HeEXz0P3A3Cxv3btWV9bdQBh/rEsHqx5NI= =O38+ -----END PGP SIGNATURE-----