Actu
Vigil@nce: Aruba Mobility Controller, two vulnerabilities
February 2011 by Vigil@nce
This bulletin was written by Vigil@nce : http://vigilance.fr/
SYNTHESIS OF THE VULNERABILITY
An attacker can use two vulnerabilities of Aruba Mobility
Controller, in order to create a denial of service or to bypass
the authentication.
– Severity: 2/4
– Creation date: 02/02/2011
IMPACTED PRODUCTS
– Aruba Networks ArubaOS
DESCRIPTION OF THE VULNERABILITY
Two vulnerabilities were announced in Aruba Mobility Controller.
A client can send a malicious 802.11 Probe Request frame, in order
to restart the Aruba access point. This frame can be sent before
the creation of a Security Association. [severity:2/4; BID-46092]
When the EAP-TLS Dot1X termination is enabled (aaa authentication
dot1x ... termination enable, termination eap-type eap-tls) on a
WLAN, an attacker can access to the network without
authentication. [severity:2/4; BID-46094]
ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN
http://vigilance.fr/vulnerability/Aruba-Mobility-Controller-
two-vulnerabilities-10322
