Aruba Networks ClearPass Policy Manager CVE-2014-6628 Remote Code Execution Vulnerability

Bugtraq ID:	74909
Class:	Input Validation Error
CVE:	CVE-2014-6628
Remote:	Yes
Local:	No
Published:	May 25 2015 12:00AM
Updated:	May 25 2015 12:00AM
Credit:	Luke Young and Cory Scott of LinkedIn.
Vulnerable:	Arubanetworks ClearPass Policy Manager 6.4.5 Arubanetworks ClearPass Policy Manager 6.4.2 Arubanetworks ClearPass Policy Manager 6.4.1 Arubanetworks ClearPass Policy Manager 6.4 Arubanetworks ClearPass Policy Manager 6.4.4 Arubanetworks ClearPass Policy Manager 6.4.3
Not Vulnerable:	Arubanetworks ClearPass Policy Manager 6.5

Aruba Networks ClearPass Policy Manager CVE-2014-6628 Remote Code Execution Vulnerability

Aruba Networks ClearPass Policy Manager is prone to an unspecified remote code-execution vulnerability.

An attacker can exploit this issue to execute arbitrary code with the privilege level of the web server. Failed exploit attempts may result in a denial-of-service condition.

Aruba Networks ClearPass Policy Manager CVE-2014-6628 Remote Code Execution Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Aruba Networks ClearPass Policy Manager CVE-2014-6628 Remote Code Execution Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Aruba Networks ClearPass Policy Manager CVE-2014-6628 Remote Code Execution Vulnerability

References:

• Aruba Networks Homepage (Aruba Networks)
  
• ClearPass Policy Manager Product page (Aruba Networks)
  
• ARUBA-PSA-2015-005 (Aruba Networks)