Multiple vulnerabilities in Aruba Network ArubaOS
| Risk | Low |
| Patch available | YES |
| Number of vulnerabilities | 3 |
| CVE-ID | CVE-2017-9000 CVE-2017-9003 |
| CWE-ID | CWE-284 CWE-119 CWE-89 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software Subscribe |
ArubaOS Operating systems & Components / Operating system |
| Vendor | Aruba Networks |
Security Bulletin
This security bulletin contains information about 3 vulnerabilities.
1) Information disclosure
EUVDB-ID: #VU8914
Risk: Low
CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-9000
CWE-ID:
CWE-284 - Improper Access Control
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.
The weakness exists due to improper access control. A remote attacker with network access to an Aruba mobility controller on TCP port 8080 or 8081 can access files which could contain passwords, keys, and other sensitive information.
The vulnerability is addressed in the following versions: 6.3.1.25, 6.4.4.16, 6.5.1.9, 6.5.3.3, 6.5.4.2, 8.1.0.4.
Vulnerable software versionsArubaOS: 6.4.4.1 - 8.1.0.2
External linkshttp://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-006.txt
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Memory corruption
EUVDB-ID: #VU8915
Risk: Low
CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-9003
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to cause DoS condition or possibly execute arbitrary code on the target system.
The weakness exists due to boundary error. A remote attacker can supply a specially crafted input, trigger multiple memory corruptions, cause ArubaOS processes to crash and possibly execute arbitrary code.
The vulnerability is addressed in the following versions: 6.3.1.25, 6.4.4.16, 6.5.1.9, 6.5.3.3, 6.5.4.2, 8.1.0.4.
Vulnerable software versionsArubaOS: 6.4.4.1 - 8.1.0.2
External linkshttp://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-006.txt
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) SQL injection
EUVDB-ID: #VU8916
Risk: Low
CVSSv3.1: 3.9 [CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: N/A
CWE-ID:
CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Exploit availability: No
DescriptionThe vulnerability allows a remote administrative attacker to execute SQL commands on the target system.
The weakness exists due to improper validation of user-supplied input. A remote attacker with access to the management interface can supply a specially crafted parameter value and execute SQL commands to read or write arbitrary data.
The vulnerability is addressed in the following versions: 6.3.1.25, 6.4.4.16, 6.5.1.9, 6.5.3.3, 6.5.4.2, 8.1.0.4.
Vulnerable software versionsArubaOS: 6.4.4.1 - 8.1.0.2
External linkshttp://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-006.txt
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
