Aruba Mobility Controller 802.11 Association Request Frame Remote Denial of Service Vulnerability

Bugtraq ID:	36832
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Oct 26 2009 12:00AM
Updated:	Oct 27 2009 07:48PM
Credit:	The vendor reported this issue.
Vulnerable:	Aruba Networks ArubaOS 3.4 .2 Aruba Networks ArubaOS 3.3.2 6 Aruba Networks ArubaOS 3.3.2 .17 Aruba Networks ArubaOS 3.3.2 .11 Aruba Networks ArubaOS 3.3.1 .29 Aruba Networks ArubaOS 3.3.1 .24 Aruba Networks ArubaOS 3.3.1 Aruba Networks ArubaOS RN 3.1.0 Aruba Networks ArubaOS 3.3.2.13-FIPS
Not Vulnerable:	Aruba Networks ArubaOS 3.4 .3 Aruba Networks ArubaOS 3.3.2 .18 Aruba Networks ArubaOS 3.3.1 .30 Aruba Networks ArubaOS RN 3.1.1 Aruba Networks ArubaOS 3.3.2.14-FIPS

Aruba Mobility Controller 802.11 Association Request Frame Remote Denial of Service Vulnerability

Aruba Mobility Controller is prone to a remote denial-of-service vulnerability.

A remote attacker can exploit this issue to cause the affected device to restart, denying service to legitimate users.

The following versions of ArubaOS in the Aruba Mobility Controller are affected:

3.3.1.x
3.3.2.x
RN 3.1.x
3.4.x
3.3.2.x-FIPS

Aruba Mobility Controller 802.11 Association Request Frame Remote Denial of Service Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Aruba Mobility Controller 802.11 Association Request Frame Remote Denial of Service Vulnerability

Solution:
Updates are available. Please see the references for details.

Aruba Mobility Controller 802.11 Association Request Frame Remote Denial of Service Vulnerability

References:

• Aruba Mobility Controller Homepage (Aruba Networks)
  
• Aruba Networks Advisory ID: AID-102609 - Malformed 802.11 Association Request f (Robbie Gill )
  
• Malformed 802.11 Association Request frame causes Denial of Service condition on (Aruba Networks)