CVE-2007-0932 – Aruba Authentication Bypass / Insecure Transport / Tons Of Issues

https://notcve.org/view.php?id=CVE-2007-0932

The (1) Aruba Mobility Controllers 200, 600, 2400, and 6000 and (2) Alcatel-Lucent OmniAccess Wireless 43xx and 6000 do not properly implement authentication and privilege assignment for the guest account, which allows remote attackers to access administrative interfaces or the WLAN. Los (1) controladores Aruba Mobility versiones 200, 600, 2400 y 6000 y (2) Alcatel-Lucent OmniAccess Wireless versiones 43xx y 6000 implementan de manera inapropiada la autenticación y la asignación de privilegios para la cuenta del invitado, lo que permite a los atacantes remotos acceder a interfaces administrativas o a la WLAN. Multiple vulnerabilities were identified in Aruba AP, IAP and AMP devices. The vulnerabilities were discovered during a black box security assessment and therefore the vulnerability list should not be considered exhaustive. Several of the high severity vulnerabilities listed in this report are related to the Aruba proprietary PAPI protocol and allow remote compromise of affected devices. • http://lists.grok.org.uk/pipermail/full-disclosure/2007-February/052382.html http://osvdb.org/33185 http://secunia.com/advisories/24144 http://securityreason.com/securityalert/2243 http://www.kb.cert.org/vuls/id/613833 http://www.securityfocus.com/archive/1/459927/100/0/threaded http://www.securityfocus.com/bid/22538 https://exchange.xforce.ibmcloud.com/vulnerabilities/32461 • CWE-264: Permissions, Privileges, and Access Controls •