PT-2022-2382 · Aruba · Arubaos-Switch

Published 2022-05-03 · Updated 2022-05-25 · CVE-2022-23677

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ArubaOS-Switch versions 15.xx.xxxx through 16.11.xxxx: ArubaOS-Switch 16.02.xxxx versions K.16.02.0033 and below ArubaOS-Switch 16.08.xxxx versions KB/WB/WC/YA/YB/YC.16.08.0024 and below ArubaOS-Switch 16.09.xxxx versions KB/WB/WC/YA/YB/YC.16.09.0019 and below ArubaOS-Switch 16.10.xxxx versions KB/WB/WC/YA/YB/YC.16.10.0019 and below ArubaOS-Switch 16.11.xxxx versions KB/WB/WC/YA/YB/YC.16.11.0003 and below

Description A remote execution of arbitrary code issue was discovered in ArubaOS-Switch Devices. The vulnerability is related to incorrect code generation management in the NanoSSL library of the switch's firmware. Exploitation of this issue may allow a remote attacker to execute arbitrary code.

Recommendations For ArubaOS-Switch 15.xx.xxxx, update to a version outside of the affected range. For ArubaOS-Switch 16.01.xxxx, update to a version outside of the affected range. For ArubaOS-Switch 16.02.xxxx version K.16.02.0033 and below, update to a version above K.16.02.0033. For ArubaOS-Switch 16.03.xxxx, update to a version outside of the affected range. For ArubaOS-Switch 16.04.xxxx, update to a version outside of the affected range. For ArubaOS-Switch 16.05.xxxx, update to a version outside of the affected range. For ArubaOS-Switch 16.06.xxxx, update to a version outside of the affected range. For ArubaOS-Switch 16.07.xxxx, update to a version outside of the affected range. For ArubaOS-Switch 16.08.xxxx version KB/WB/WC/YA/YB/YC.16.08.0024 and below, update to a version above KB/WB/WC/YA/YB/YC.16.08.0024. For ArubaOS-Switch 16.09.xxxx version KB/WB/WC/YA/YB/YC.16.09.0019 and below, update to a version above KB/WB/WC/YA/YB/YC.16.09.0019. For ArubaOS-Switch 16.10.xxxx version KB/WB/WC/YA/YB/YC.16.10.0019 and below, update to a version above KB/WB/WC/YA/YB/YC.16.10.0019. For ArubaOS-Switch 16.11.xxxx version KB/WB/WC/YA/YB/YC.16.11.0003 and below, update to a version above KB/WB/WC/YA/YB/YC.16.11.0003.

Fix

Memory Corruption

Code Injection

Weakness Enumeration

CWE-787

CWE-94

Related Identifiers

BDU:2022-02734

CVE-2022-23677

Affected Products

Arubaos-Switch

References · 9

• https://osv.dev/vulnerability/CVE-2022-23677 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-02734 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-23677 · Security Note
• https://arubanetworks.com/assets/alert/ARUBA-PSA-2022-008.txt · Vendor Advisory
• https://t.me/true_secator/2911 · Telegram Post
• https://t.me/cvenotify/30731 · Telegram Post
• https://asp.arubanetworks.com · Note
• http://armis.com/blog/tlstorm-2-nanossl-tls-library-misuse-leads-to-vulnerabilities-in-common-switches · Note
• https://helpnetsecurity.com/2022/05/03/tlstorm-2-0 · Note