Aruba Mobility Controller Public Key Based SSH Authentication Security Bypass Vulnerability

Bugtraq ID:	34711
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Apr 24 2009 12:00AM
Updated:	Apr 27 2009 06:26PM
Credit:	The vendor
Vulnerable:	Aruba Networks ArubaOS 3.3.2 6 Aruba Networks ArubaOS 3.3.1 Aruba Networks ArubaOS RN 2.0 Aruba Networks ArubaOS RN 1.0
Not Vulnerable:	Aruba Networks ArubaOS 3.3.2 .11 Aruba Networks ArubaOS 3.3.1 .24 Aruba Networks ArubaOS 3.3.2.8-rn-2.1_20469

Aruba Mobility Controller Public Key Based SSH Authentication Security Bypass Vulnerability

Aruba Mobility Controllers are prone to a security-bypass vulnerability. This issue affects devices that are configured to authenticate users using SSH authentication based on public keys.

Attackers may exploit this issue to gain administrative access to vulnerable devices, which may aid in further attacks.

This issue affects Aruba Mobility Controllers running versions prior to the following:

ArubaOS 3.3.1.24
ArubaOS 3.3.2.11
ArubaOS 3.3.2.8-rn-2.1_20469

Aruba Mobility Controller Public Key Based SSH Authentication Security Bypass Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Aruba Mobility Controller Public Key Based SSH Authentication Security Bypass Vulnerability

Solution:
The vendor has released an advisory and updates. Please see the references for details.

Aruba Mobility Controller Public Key Based SSH Authentication Security Bypass Vulnerability

References:

• Aruba Mobility Controller Homepage (Aruba Networks)
  
• Aruba Advisory ID: AID-42309 Management User Authentication Bypass Vulnerability (Robbie Gill )
  
• Management User Authentication Bypass Vulnerability When Using Public Key Based (Aruba Networks)