|
Brought to you by:
Suppliers of:
|
|
|
| |
| A Denial of Service (DoS) vulnerability was discovered during standard bug reporting procedures in the Aruba Mobility Controller. A malformed EAP frame causes a process crash on the Aruba Mobility Controller causing a temporary DoS condition for new clients configured to use EAP authentication. Prior successful security association is not required to cause this condition. The Mobility Controller recovers automatically by restarting the affected process. |
| |
Credit:
The information has been provided by Robbie (Rupinder) Gill.
The original article can be found at: http://www.arubanetworks.com/support/alerts/aid-12808.asc
|
| |
Vulnerable Systems:
* Aruba Mobility Controller vesion 2.4.8.x-FIPS
* Aruba Mobility Controller vesion 2.5.x
* Aruba Mobility Controller vesion 3.1.x
* Aruba Mobility Controller vesion 3.2.x
* Aruba Mobility Controller vesion 3.3.1.x
* Aruba Mobility Controller vesion 3.3.2.x
Immune Systems:
*
Extensible Authentication Protocol (EAP) is a framework used for authentication in wireless and point-point connections (RFC 3748). Aruba Mobility Controller accepts EAP frames on both wireless interfaces (via its thin APs) and wired interfaces (via devices
connected to untrusted physical ports on the controller). In 802.11 networks, EAP frames are only used when WPA/WPA2 Enterprise modes are being used.
A malformed EAP frame causes a process crash on the Aruba Mobility Controller. An attacking station does not need to have completed a successful security association prior to launching this attack against the controller.
Impact:
An attacker can inject a malformed EAP frame and cause a process crash on the Aruba Mobility Controller. This causes a service outage for new clients configured to use EAP authentication. The Mobility Controller recovers automatically by restarting the affected process. An attacker could however cause a prolonged DoS condition by flooding the Aruba Mobility Controller with
malicious EAP frames.
For wireless, this vulnerability only applies when operating in WPA/WPA2 Enterprise modes. WPA/WPA2-PSK modes are unaffected by this vulnerability and so are open/WEP based wireless networks. This vulnerability does affect wired devices connected to untrusted physical ports of the Mobility Controller.
Workaround:
Aruba Networks recommends that all customers that are using EAP authentication apply the appropriate patch(es) as soon as practical. However, in the event that a patch cannot immediately be applied, the following steps might help in mitigating the risk:
- - Aruba Mobility Controllers allows for a mode of operation where a wireless client's EAP communication terminates on the controller, rather than on an authentication server (RADIUS server, LDAP server etc.). The Mobility Controller in turn queries the authentication server on behalf of the client using non EAP messages. This mode is referred to as "EAP-Offload" and is immune to this vulnerability. Enabling this mode on the Mobility Controller can be used as a workaround until the patch(es) can be applied. EAP-Offload is not supported for wired client devices.
Solution:
Aruba Networks recommends that all customers apply the appropriate patch(es) as soon as practical. However, in the event that a patch can not immediately be applied, the workaround steps will help to mitigate the risk.
|
|
|
|
|
