n.runs AG http://www.nruns.com/ security at nruns.com n.runs-SA-2007.001 8-Feb-2007 ________________________________________________________________________ Vendor: Aruba Networks, http://www.arubanetworks.com Affected Products: Aruba Mobility Controllers 200, 600, 2400, 6000 Alcatel-Lucent OmniAccess Wireless 43xx and 6000 Vulnerability: Unauthorized Administrative and WLAN Access through Guest Account Risk: HIGH CERT VU ID: VU#319913 Vendor communication: 2007/01/11 Initial notification to Aruba WSIRT 2007/01/11 Aruba WSIRT assigns contact 2007/01/15 Aruba provides feedback on the vulnerability. 2007/01/18 Patches available 2007/01/28 n.runs verifies patched firmware Systems Affected: All Aruba Networks Mobility Controllers (200, 800, 2400, and 6000) running software versions greater than 2.0 Alcatel-Lucent OmniAccess Wireless 43xx and 6000 running software versions 2.0 and later. Overview: A flaw in an authorization component allows for unauthorized access to the Wireless LAN through a Captive Portal, VPN, and administrative access using either the web-based administration or the command line interface. This vulnerability affects all versions of the Aruba Controller beginning with version 2.3. Description: To provide access to guest users on the Captive Portal, a built-in guest account exists in the aforementioned firmware releases. An implementation error has lead to a flaw which allows anyone in possession of this account’s logon name to authenticate to the administrative interfaces or the WLAN without specifying a password. Impact: If the management interfaces are reachable, an attacker can gain full control over the device through this account. Likewise, an attacker may gain unauthorized access to the WLAN, if no other security safeguards such as WPA-PSK are in place. If WLAN access control is enforced through VPN client authentication, a compromise of the WLAN is possible if the attacker can provide the group key for the VPN. Solution: Aruba Networks has made patched firmware available to their customers, who should be able to retrieve it through Aruba's support site https://support.arubanetworks.com. As a workaround, restrict access to the administrative interfaces or disable them, reverting to console-only administration. Disable the Captive Portal. Require MSCHAPv2 for VPN authentication. Credit: Bugs found by Jan Münther and Maxim Salomon of n.runs AG. Special thanks to Scott Kelly of Aruba Networks for the quick and professional handling of this issue. ____________________________________________________________________ Unaltered electronic reproduction of this advisory is permitted. For all other reproduction or publication, in printing or otherwise, contact security at nruns.com for permission. Use of the advisory constitutes acceptance for use in an "as is" condition. All warranties are excluded. In no event shall n.runs be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if n.runs has been advised of the possibility of such damages. Copyright 2007 n.runs AG. All rights reserved. Terms of use.