Test ID:	1.3.6.1.4.1.25623.1.0.105733
Category:	General
Title:	ArubaOS Multiple Vulnerabilities (ARUBA-PSA-2016-007)
Summary:	ArubaOS is prone to multiple vulnerabilities.
Description:	Summary: ArubaOS is prone to multiple vulnerabilities. Vulnerability Insight: A buffer over-read vulnerability allows an unauthenticated user to read from uninitialized memory locations. Based on analysis of the flaw, Aruba does not believe that this memory is likely to contain sensitive information. The Broadcom Wi-Fi driver used in the AP-2xx series access points allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted wireless control message packets. The attacker must be joined to the network (wired or wireless) - this vulnerability may not be exercised by an unauthenticated user against a WPA2 network. A flaw in the ISC DHCP server allows remote attackers to cause a denial of service (application crash) via an invalid length field in a UDP IPv4 packet. The flawed DHCP server is incorporated into ArubaOS. If the DHCP server is enabled in an Aruba mobility controller, an attacker could cause it to crash. ArubaOS would automatically restart the process. However, DHCP services would be disrupted temporarily. Affected Software/OS: - ArubaOS 6.3 prior to 6.3.1.21 - ArubaOS 6.4.2.x prior to 6.4.2.16 - ArubaOS 6.4.3.x prior to 6.4.3.7 - ArubaOS 6.4.4.x prior to 6.4.4.5 Solution: Update to version 6.3.1.21, 6.4.2.16, 6.4.3.7, 6.4.4.5 or later. CVSS Score: 8.3 CVSS Vector: AV:A/AC:L/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2016-0801 http://lists.apple.com/archives/security-announce/2016/Mar/msg00000.html http://lists.apple.com/archives/security-announce/2016/Mar/msg00001.html http://lists.apple.com/archives/security-announce/2016/Mar/msg00002.html http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html https://www.exploit-db.com/exploits/39801/ https://lists.debian.org/debian-lts-announce/2018/11/msg00015.html http://www.securitytracker.com/id/1035353 Common Vulnerability Exposure (CVE) ID: CVE-2016-0802 Common Vulnerability Exposure (CVE) ID: CVE-2015-8605 BugTraq ID: 80703 http://www.securityfocus.com/bid/80703 Debian Security Information: DSA-3442 (Google Search) http://www.debian.org/security/2016/dsa-3442 http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175594.html http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176031.html http://www.securitytracker.com/id/1034657 SuSE Security Announcement: openSUSE-SU-2016:0601 (Google Search) http://lists.opensuse.org/opensuse-updates/2016-02/msg00162.html SuSE Security Announcement: openSUSE-SU-2016:0610 (Google Search) http://lists.opensuse.org/opensuse-updates/2016-02/msg00168.html http://www.ubuntu.com/usn/USN-2868-1
Copyright	Copyright (C) 2016 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.