Vulnerability

CERT-In Vulnerability Note CIVN-2024-0151
Multiple vulnerabilities in Aruba products

Original Issue Date:May 03, 2024

Severity Rating: HIGH

Software Affected

Aruba OS 10.5.x.x: to 10.5.1.0 and below
Aruba OS 10.4.x.x: to 10.4.1.0 and below
Aruba OS 8.11.x.x: to 8.11.2.1 and below
Aruba OS 8.10.x.x: to 8.10.0.10 and below
HPE Aruba Networking � Mobility Conductor, Controllers, WLAN Gateways and SD-WAN Gateways managed by Aruba Central

End of Maintenance software versions (not patched by this advisory):

ArubaOS 10.3.x.x
ArubaOS 8.9.x.x
ArubaOS 8.8.x.x
ArubaOS 8.7.x.x
ArubaOS 8.6.x.x
ArubaOS 6.5.4.x
SD-WAN 8.7.0.0-2.3.0.x
SD-WAN 8.6.0.4-2.2.x.x

Overview

Multiple vulnerabilities have been reported in Aruba Products which could allow a remote attacker to execute arbitrary code and cause a denial-of-service (DoS) condition on the targeted system.

Description

1. Buffer Overflow Vulnerability ( CVE-2024-26304 CVE-2024-26305 CVE-2024-33511 CVE-2024-33512 CVE-2024-33513 CVE-2024-33514 CVE-2024-33515 )

These Buffer Overflow Vulnerabilities exist in multiple components of ArubaOS which could be exploited by a remote unauthenticated attacker by sending specially crafted packets destined to the PAPI (Arubas access point management protocol) UDP port (8211).
Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code as a privileged user, on the targeted system.

2. Denial of Service (DoS) Vulnerability ( CVE-2024-33516 CVE-2024-33517 CVE-2024-33518 )

These Denial of Service Vulnerabilities exist in multiple components of ArubaOS accessed via the PAPI protocol which could be exploited by an unauthenticated attacker.
Successful exploitation of these vulnerabilities could allow an attacker to interrupt the normal operation services on the targeted system.

Workaround

Enabling the Enhanced PAPI Security feature using a non-default key will prevent exploitation of this vulnerability in ArubaOS 8.x. For ArubaOS 10.x this issue does not apply; upgrading to one of the recommended ArubaOS 10.x version will resolve the other ArubaOS 10.x vulnerabilities covered in this advisory.

Solution

Apply appropriate fixes as mentioned in Aruba Network Security Advisory:
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-004.txt

Vendor Information

Aruba Network
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-004.txt

References

Aruba Network
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-004.txt

CVE Name
CVE-2024-26304
CVE-2024-26305
CVE-2024-33511
CVE-2024-33512
CVE-2024-33513
CVE-2024-33514
CVE-2024-33515
CVE-2024-33516
CVE-2024-33517
CVE-2024-33518

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-22902657

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India