Aruba Networks ClearPass Policy Manager CVE-2014-8367 Unspecified SQL Injection Vulnerability

Bugtraq ID:	71357
Class:	Input Validation Error
CVE:	CVE-2014-8367
Remote:	Yes
Local:	No
Published:	Nov 19 2014 12:00AM
Updated:	Nov 19 2014 12:00AM
Credit:	Luke Young
Vulnerable:	Arubanetworks ClearPass Policy Manager 6.4.1 Arubanetworks ClearPass Policy Manager 6.3.5 Arubanetworks ClearPass Policy Manager 6.2
Not Vulnerable:	Arubanetworks ClearPass Policy Manager 6.4.2 Arubanetworks ClearPass Policy Manager 6.3.6

Aruba Networks ClearPass Policy Manager CVE-2014-8367 Unspecified SQL Injection Vulnerability

Aruba Networks ClearPass Policy Manager is prone to an unspecified SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input before using it in an SQL query.

An attacker can exploit this issue by manipulating the SQL query logic to obtain sensitive information or to carry out unauthorized actions on the underlying database.

The following products are vulnerable:

ClearPass Policy Manager 6.2.x
ClearPass Policy Manager 6.3.5 and prior
ClearPass Policy Manager 6.4.1 and prior

Aruba Networks ClearPass Policy Manager CVE-2014-8367 Unspecified SQL Injection Vulnerability

Attackers can use a browser to exploit this issue.

Aruba Networks ClearPass Policy Manager CVE-2014-8367 Unspecified SQL Injection Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Aruba Networks ClearPass Policy Manager CVE-2014-8367 Unspecified SQL Injection Vulnerability

References:

• ClearPass Policy Manager Product page (Aruba Networks)
  
• Advisory Number 11192014 (arubanetworks)