PT-2022-2383 · Aruba · Arubaos-Switch

Published 2022-05-03 · Updated 2022-05-25 · CVE-2022-23676

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ArubaOS-Switch versions 15.xx.xxxx through 16.11.xxxx

Description A remote execution of arbitrary code issue was discovered, caused by a buffer overflow in the dynamic memory of the RADIUS protocol implementation. This allows a remote attacker to execute arbitrary code. The vulnerability affects various Aruba switch models, including Aruba 5400R, Aruba 3810, Aruba 2920, Aruba 2930F, Aruba 2930M, Aruba 2530, and Aruba 2540.

Recommendations For ArubaOS-Switch versions 15.xx.xxxx through 16.11.xxxx, upgrade to a version that addresses these security vulnerabilities, as released by Aruba. As a temporary workaround, consider restricting access to the RADIUS protocol implementation until a patch is available.

Fix

Memory Corruption

Heap Based Buffer Overflow

Weakness Enumeration

CWE-787

CWE-122

Related Identifiers

BDU:2022-02735

CVE-2022-23676

Affected Products

Arubaos-Switch

References · 9

• https://bdu.fstec.ru/vul/2022-02735 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-23676 · Security Note
• https://osv.dev/vulnerability/CVE-2022-23676 · Vendor Advisory
• https://arubanetworks.com/assets/alert/ARUBA-PSA-2022-008.txt · Vendor Advisory
• https://t.me/true_secator/2911 · Telegram Post
• https://t.me/cvenotify/30730 · Telegram Post
• https://asp.arubanetworks.com · Note
• http://armis.com/blog/tlstorm-2-nanossl-tls-library-misuse-leads-to-vulnerabilities-in-common-switches · Note
• https://helpnetsecurity.com/2022/05/03/tlstorm-2-0 · Note