-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ADVISORY NUMBER 031912 ADVISORY # 1: TITLE Aruba Remote Access Point Diagnostic Web Interface OS Command Injection Vulnerability in Aruba Remote Access Point Diagnostic Web Interface在Aruba远程接入点的诊断Web界面中发现了一个操作系统命令注入漏洞。运行诊断web界面时，未经身份验证的攻击者可能会以root用户的身份在Remote设备上执行任意的系统命令。受影响的ArubaOS版本5.0.x。x, . x。x, 6.1.x。远程接入点提供一个web界面，方便设备的初始配置。这个web界面提供了运行一些基本的网络诊断和输入成功配置所需的配置参数的功能。在此web界面中发现了一个操作系统命令注入漏洞，恶意用户输入可以通过表单元素注入，并以root用户的身份在设备上运行任意系统命令。这个诊断web界面可以在设备初始配置后禁用。IMPACT未经认证的攻击者可以以root用户身份在设备上执行任意系统命令。这可能会导致该设备操作系统的全面崩溃。 This vulnerability applies only to the Aruba Remote Access Point and other Aruba devices are not affected. CVSS v2 BASE METRIC SCORE: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) WORKAROUNDS Aruba Networks recommends not allowing access to the Aruba Remote Access Point's diagnostic web interface after initial provisioning by applying an access list (acl) to block HTTP and HTTPS protocol to its local IP. This restricted acl needs to be in the highest position of the acl rules for each user-role that should not have access to the diagnostic web interface. Example restricted IP access list added to a user-role called guest: ip access-list session local_debug_restricted user localip svc-http deny user localip svc-https deny user-role guest access-list session local_debug_restricted access-list session dns-acl access-list session dhcp-acl access-list session icmp-acl access-list session http-acl access-list session https-acl SOLUTION Aruba Networks recommends that all customers apply the appropriate patch(es) as soon as practical. The following patches have the fix (any newer patch will also have the fix): - - - ArubaOS 5.0.4.2 - - - ArubaOS 6.0.2.1 - - - ArubaOS 6.1.2.4 CREDITS This vulnerability was discovered and reported by Greg Ose of CME GROUP. +---------------------------------------------------- Advisory # 2: TITLE 802.1X User Authentication Bypass Vulnerability when EAP-TLS 802.1X local termination is enabled on WLAN. SUMMARY An EAP-TLS 802.1X user authentication bypass vulnerability was discovered during standard internal bug reporting procedures in the Aruba Mobility Controller. This vulnerability only affects customers with EAP-TLS 802.1X local termination enabled. AFFECTED ArubaOS VERSIONS 6.1.x.x DETAILS Aruba Mobility Controllers allow for local termination of EAP-TLS 802.1X authentication of wireless users accessing the network. Local 802.1X termination allows rapid deployment of WLAN without requiring an external authentication server capable of EAP-TLS authentication. A vulnerability in the EAP-TLS 802.1X termination component in the Mobility Controller may allow unauthorized network access to some users. EAP-TLS 802.1X termination is not the default setup and must be configured manually for before it will be used. Wireless and wired users authenticating to an external authentication server are NOT vulnerable. Other WLANs and other wired ports on the same Mobility Controller that do not use local termination of 802.1X EAP-TLS are NOT affected by this vulnerability. IMPACT An EAP-TLS 802.1X user may be able to gain unauthorized access to a WLAN or a wired port configured with local 802.1X termination of EAP-TLS authentications on the Aruba Mobility Controller. CVSS v2 BASE METRIC SCORE: 6.1 (AV:A/AC:L/AU:N/C:C/I:N/A:N) HOW TO IDENTIFY IF YOU ARE VULNERABLE If the following lines exist in your configuration for a particular aaa profile and that profile is assigned to an active virtual ap or wired port, then you are vulnerable. aaa authentication dot1x 终端启用终端eap类型eap tls！Aruba Networks建议所有客户尽快应用适当的补丁。但是，如果无法立即应用补丁，以下步骤将有助于降低风险：--禁用无线和有线用户的EAP-TLS 802.1X本地终端，直到可以应用补丁，并切换到使用外部EAP-TLS服务器对无线用户进行身份验证。如果无法禁用本地802.1X终端，请切换到使用其他EAP方法对无线和有线用户进行身份验证。解决方案Aruba Networks建议所有客户尽快应用适当的补丁。以下修补程序有修复程序（任何更新的修补程序也会有修复程序）：——-ArubaOS 6.1.2.6+-------------------------------------------------------------获得固定固件Aruba客户可以在技术支持网站上获得固件：//www.nexbus-cng.com/support 阿鲁巴支持联系人如下：1-800-WiFiLAN（1-800-943-4526）（北美境内免费电话）+1-408-754-1200（世界任何地方的长途电话）完整联系人名单如下：//www.nexbus-cng.com/support-services/aruba-support-program/contact-support/ 电子邮件：支持（位于）arubanetworks.com，请不要联系“wsirt（at）arubanetworks.com”或“security（at）arubanetworks.com”对于软件升级、利用和公告，此漏洞将在Aruba W.S.I.R.T.咨询中心公布：//www.nexbus-cng.com/support/alerts/aid-031912.asc SecurityFocus Bugtraqhttp://www.securityfocus.com/archive/1 本通知的状态：最终，尽管阿鲁巴网络无法保证所有声明的准确性在本咨询中，所有事实均已尽我们所能进行了检查。阿鲁巴网络公司预计不会发布本咨询的更新版本，除非事实发生重大变化。如果事实发生重大变化，阿鲁巴网络公司可能会更新本咨询。本咨询的独立副本或释义以下章节中省略分发URL的本安全公告为非受控副本，可能缺少重要信息或包含事实错误。本公告的分发本公告将发布在阿鲁巴网站上，网址为：//www.nexbus-cng.com/support/alerts/aid-031912.asc 如有必要，本咨询的未来更新任何，将被放置在阿鲁巴的全球网站上，但可能会或可能不会在邮件列表或新闻组中积极公布。鼓励关心此问题的用户检查上述URL以获取任何更新。修订历史版本1.0/03-19-2012/首次发布阿鲁巴WSIRT安全程序完整的报告安全信息Aruba Networks产品中的漏洞，可在//www.nexbus-cng.com/support-services/security-bulletins/ 对于报告*新*阿鲁巴网络安全问题，可将电子邮件发送至wsirt（at）arubanetworks.com或security（at）对于敏感信息，我们鼓励使用PGP加密。我们的公钥可在//www.nexbus-cng.com/support-services/security-bulletins/ （c）Aruba Networks，Inc.2012年版权所有。如果重新分发的副本完整且未经修改，包括所有日期和版本信息，本公告可在正文顶部给出的发布日期后自由重新分发。----BEGIN PGP签名------版本：GnuPG/MacGPG2 v2.0.17（达尔文）注释：GPGTools-http://gpgtools.org IEyeareCayfak9nco0acgkp6kija4qefvjdgcg8hzmeuneysbuserndoh3y/5u+RAAoIigvSP8t8cTCLVCQATl3CXnHWFc=pXB1------结束PGP签名-----