ArubaOS 6.3.1.11 / 6.4.2.1 SSH Authentication Bypass

high Nessus Plugin ID 78510

Language:

Synopsis

The version of ArubaOS has an authentication bypass vulnerability.

Description

The version of ArubaOS has an unspecified vulnerability that allows a remote attacker to obtain limited administrative privileges without valid credentials. The vulnerability affects access over SSH. However, access through WebUI and the serial port is not affected, and the vulnerability does not provide 'root' level access, although it could allow the following activities :

- Issue 'show' commands.

- Obtain encrypted password hashes for administrative accounts.

- View the running configuration.

- Add users to the internal user database with 'guest' rights.

Solution

Upgrade to 6.3.1.12 / 6.4.2.2 or downgrade to 6.3.1.10 / 6.4.2.0.

Plugin Details

Severity: High

ID: 78510

File Name: arubaos_auth_bypass_aid-10072014.nasl

Version: 1.8

Type: remote

Family: Misc.

Published: 10/16/2014

Updated: 11/25/2019

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.8

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: cpe:/o:arubanetworks:arubaos

Required KB Items: Host/ArubaNetworks/ArubaOS/version

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 10/7/2014

Vulnerability Publication Date: 10/7/2014

Reference Information

CVE: CVE-2014-7299

Detections

Analytics