Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Network Security

Aruba Patches Vulnerabilities in AirWave Product

HPE-owned network access solutions provider Aruba has patched XML external entity (XXE) and cross-site scripting (XSS) vulnerabilities in its AirWave network management platform.

The vulnerabilities were reported to Aruba by Pichaya Morimoto of SEC Consult and independently by two other researchers. Both weaknesses affect AirWave’s VisualRF component.

HPE-owned network access solutions provider Aruba has patched XML external entity (XXE) and cross-site scripting (XSS) vulnerabilities in its AirWave network management platform.

The vulnerabilities were reported to Aruba by Pichaya Morimoto of SEC Consult and independently by two other researchers. Both weaknesses affect AirWave’s VisualRF component.

The XXE flaw, tracked as CVE-2016-8526, allows a low-privileged user to read files on the system, including ones that could include passwords, which could lead to privilege escalation.

According to Aruba, this security hole is considered low risk on AirWave systems with a single administrator, but the risk increases in environments with users that have different privilege levels.

“The vulnerability can be exploited by a low privileged read-only user to read sensitive information / files with malicious XML code,” SEC Consult said in its advisory. “Note that as Aruba’s passwords are encrypted with a shared static key, privilege escalation to admin role is also possible!”

The reflected XSS flaw, identified as CVE-2016-8527, can allow an attacker to obtain sensitive information, such as passwords and session cookies, but they need to trick an AirWave administrator into clicking on a specially crafted link.

The vulnerabilities were reported by SEC Consult in late November 2016 and they were fixed on February 21 with the release of AirWave 8.2.3.1. SEC Consult has classified the flaws as “high impact,” but Aruba has assigned them a “medium” severity rating.

Last year, Google security engineer Sven Blumenstein reported finding more than two dozen vulnerabilities in Aruba products, including ArubaOS, AirWave and Aruba Instant.

This is also not the first time SEC Consult has analyzed Aruba products. As part of its research into the reuse of cryptographic keys, the security firm discovered that Aruba had been using the same certificate for tens of thousands of devices.

Aruba has been running a private bug bounty program on BugCrowd with rewards of up to $1,500 per vulnerability.

Related: Cisco CloudCenter Orchestrator Flaw Exploited in Attacks

Related: Serious Vulnerabilities Found in McAfee Enterprise Product

Related: Symantec Patches DLL Hijacking Flaw in Enterprise Products

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Expert Insights

Related Content

Cyberwarfare

Websites of German airports, administration bodies and banks were hit by DDoS attacks attributed to Russian hacker group Killnet

Network Security

NSA publishes guidance to help system administrators identify and mitigate cyber risks associated with transitioning to IPv6.

Identity & Access

Hackers rarely hack in anymore. They log in using stolen, weak, default, or otherwise compromised credentials. That’s why it’s so critical to break the...

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

IoT Security

Lexmark warns of a remote code execution (RCE) vulnerability impacting over 120 printer models, for which PoC code has been published.

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Email Security

Microsoft is urging customers to install the latest Exchange Server updates and harden their environments to prevent malicious attacks.

Application Security

Drupal released updates that resolve four vulnerabilities in Drupal core and three plugins.