RETIRED: Aruba Mobility Controller Shared X.509 Certificate Security Bypass Vulnerability
BID:31336
Info
RETIRED: Aruba Mobility Controller Shared X.509 Certificate Security Bypass Vulnerability
| Bugtraq ID: | 31336 |
| Class: | Design Error |
| CVE: |
CVE-2008-7023 |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 23 2008 12:00AM |
| Updated: | May 12 2015 07:48PM |
| Credit: | nnposter |
| Vulnerable: |
Arubanetworks Aruba Mobility Controllers 2.5.4 .18 Arubanetworks Aruba Mobility Controllers 2.5.4 .17 Arubanetworks Aruba Mobility Controllers 2.4.8 .6-FIPS Arubanetworks Aruba Mobility Controllers 2.4.8 .5-FIPS Arubanetworks Aruba Mobility Controllers 3.3.1.6 Arubanetworks Aruba Mobility Controllers 3.3.1.0 Arubanetworks Aruba Mobility Controllers 3.2.0.0 Arubanetworks Aruba Mobility Controllers 3.1.1.3 Arubanetworks Aruba Mobility Controllers 3.1.1.0-FIPS Arubanetworks Aruba Mobility Controllers 3.1.1.0 Arubanetworks Aruba Mobility Controllers 2.5.6.0 Arubanetworks Aruba Mobility Controllers 2.5.5.7 Arubanetworks Aruba Mobility Controllers 2.5.5.0 Arubanetworks Aruba Mobility Controllers 2.5.4.25 Arubanetworks Aruba Mobility Controllers 2.5.2.11 Arubanetworks Aruba Mobility Controllers 2.4.8.11-FIPS Arubanetworks Aruba Mobility Controllers 2.4.8.0-FIPS Arubanetworks Aruba Mobility Controllers 2.3.6.15 Arubanetworks Aruba Mobility Controller 800 2.5.4.8 Arubanetworks Aruba Mobility Controller 800 2.5.4.18 Arubanetworks Aruba Mobility Controller 800 2.5.4.17 Arubanetworks Aruba Mobility Controller 800 2.4.8.6-FIPS Arubanetworks Aruba Mobility Controller 800 2.4.8.6 Arubanetworks Aruba Mobility Controller (Firmware) 2.0 Arubanetworks Aruba Mobility Controller 2.5.6 Arubanetworks Aruba Mobility Controller 800 Arubanetworks Aruba Mobility Controller 6000 Arubanetworks Aruba Mobility Controller 6.1.2.6 Arubanetworks Aruba Mobility Controller 2400 Arubanetworks Aruba Mobility Controller 2.5.6.0 Arubanetworks Aruba Mobility Controller 2.4.8.0-FIPS |
| Not Vulnerable: | |
Discussion
RETIRED: Aruba Mobility Controller Shared X.509 Certificate Security Bypass Vulnerability
Aruba Mobility Controllers are prone to a security-bypass vulnerability because the device's web-based management interface does not require administrators to replace default certificates.
Successfully exploiting this issue allows attackers to use a private key from one implementation to masquerade as an administrator on other implementations. Successful attacks will result in the complete compromise of the device.
This issue affects Aruba Mobility Controllers running ArubaOS 3.3.1.16; previous versions are likely also affected.
UPDATE: This BID is being retired because the vendor's instructions state that the default certificate is intended for demonstration purposes only; users are instructed to obtain and install site-specific certificates.
Aruba Mobility Controllers are prone to a security-bypass vulnerability because the device's web-based management interface does not require administrators to replace default certificates.
Successfully exploiting this issue allows attackers to use a private key from one implementation to masquerade as an administrator on other implementations. Successful attacks will result in the complete compromise of the device.
This issue affects Aruba Mobility Controllers running ArubaOS 3.3.1.16; previous versions are likely also affected.
UPDATE: This BID is being retired because the vendor's instructions state that the default certificate is intended for demonstration purposes only; users are instructed to obtain and install site-specific certificates.
Exploit / POC
RETIRED: Aruba Mobility Controller Shared X.509 Certificate Security Bypass Vulnerability
Attackers can use standard tools to exploit this issue.
Attackers can use standard tools to exploit this issue.
Solution / Fix
RETIRED: Aruba Mobility Controller Shared X.509 Certificate Security Bypass Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
RETIRED: Aruba Mobility Controller Shared X.509 Certificate Security Bypass Vulnerability
References:
References:
- Aruba Mobility Controller Homepage (Aruba Networks)
- Aruba Mobility Controller Shared Default Certificate ([email protected])
- Re: Aruba Mobility Controller Shared Default Certificate - Response from Aruba ("Robbie \(Rupinder\) Gill"