cve-2018-7081
Vulnerability from cvelistv5
Published
2019-09-13 16:49
Modified
2024-08-05 06:17
Severity ?
Summary
A remote code execution vulnerability is present in network-listening components in some versions of ArubaOS. An attacker with the ability to transmit specially-crafted IP traffic to a mobility controller could exploit this vulnerability and cause a process crash or to execute arbitrary code within the underlying operating system with full system privileges. Such an attack could lead to complete system compromise. The ability to transmit traffic to an IP interface on the mobility controller is required to carry out an attack. The attack leverages the PAPI protocol (UDP port 8211). If the mobility controller is only bridging L2 traffic to an uplink and does not have an IP address that is accessible to the attacker, it cannot be attacked.
References
security-alert@hpe.comhttps://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-004.txtVendor Advisory
security-alert@hpe.comhttps://x-c3ll.github.io/posts/CVE-2018-7081-RCE-ArubaOS/Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-004.txtVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://x-c3ll.github.io/posts/CVE-2018-7081-RCE-ArubaOS/Exploit, Third Party Advisory
Impacted products
Vendor Product Version
n/a Aruba Mobility Controllers Version: Aruba Mobility Controller firmware (ArubaOS) 6.x prior to 6.4.4.21 6.5.x prior to 6.5.4.13 8.x prior to 8.2.2.6 8.3.0.x prior to 8.3.0.7, 8.4.0.x and prior to 8.4.0.3
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T06:17:17.386Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-004.txt"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://x-c3ll.github.io/posts/CVE-2018-7081-RCE-ArubaOS/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Aruba Mobility Controllers",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Aruba Mobility Controller firmware (ArubaOS) 6.x prior to 6.4.4.21 6.5.x prior to 6.5.4.13  8.x prior to 8.2.2.6  8.3.0.x prior to 8.3.0.7, 8.4.0.x and prior to 8.4.0.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A remote code execution vulnerability is present in network-listening components in some versions of ArubaOS. An attacker with the ability to transmit specially-crafted IP traffic to a mobility controller could exploit this vulnerability and cause a process crash or to execute arbitrary code within the underlying operating system with full system privileges. Such an attack could lead to complete system compromise. The ability to transmit traffic to an IP interface on the mobility controller is required to carry out an attack. The attack leverages the PAPI protocol (UDP port 8211). If the mobility controller is only bridging L2 traffic to an uplink and does not have an IP address that is accessible to the attacker, it cannot be attacked."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "remote code execution",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-09-13T19:00:10",
        "orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
        "shortName": "hpe"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-004.txt"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://x-c3ll.github.io/posts/CVE-2018-7081-RCE-ArubaOS/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-alert@hpe.com",
          "ID": "CVE-2018-7081",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Aruba Mobility Controllers",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Aruba Mobility Controller firmware (ArubaOS) 6.x prior to 6.4.4.21 6.5.x prior to 6.5.4.13  8.x prior to 8.2.2.6  8.3.0.x prior to 8.3.0.7, 8.4.0.x and prior to 8.4.0.3"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A remote code execution vulnerability is present in network-listening components in some versions of ArubaOS. An attacker with the ability to transmit specially-crafted IP traffic to a mobility controller could exploit this vulnerability and cause a process crash or to execute arbitrary code within the underlying operating system with full system privileges. Such an attack could lead to complete system compromise. The ability to transmit traffic to an IP interface on the mobility controller is required to carry out an attack. The attack leverages the PAPI protocol (UDP port 8211). If the mobility controller is only bridging L2 traffic to an uplink and does not have an IP address that is accessible to the attacker, it cannot be attacked."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "remote code execution"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-004.txt",
              "refsource": "CONFIRM",
              "url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-004.txt"
            },
            {
              "name": "https://x-c3ll.github.io/posts/CVE-2018-7081-RCE-ArubaOS/",
              "refsource": "MISC",
              "url": "https://x-c3ll.github.io/posts/CVE-2018-7081-RCE-ArubaOS/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
    "assignerShortName": "hpe",
    "cveId": "CVE-2018-7081",
    "datePublished": "2019-09-13T16:49:09",
    "dateReserved": "2018-02-15T00:00:00",
    "dateUpdated": "2024-08-05T06:17:17.386Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"6.4.4.21\", \"matchCriteriaId\": \"DDEB8052-8974-4F8B-9C64-DCE9D7C76753\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.5.0.0\", \"versionEndExcluding\": \"6.5.4.13\", \"matchCriteriaId\": \"16F5E9C2-A354-4F33-9D65-2A9FBDE6D085\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"8.0.0.0\", \"versionEndExcluding\": \"8.2.2.6\", \"matchCriteriaId\": \"DD6448CB-1D2B-47A4-9F70-0CDBE4F35858\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"8.3.0.0\", \"versionEndExcluding\": \"8.3.0.7\", \"matchCriteriaId\": \"E7F19B7F-1E7B-4C6E-AEB5-2755D10CA6CE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"8.4.0.0\", \"versionEndExcluding\": \"8.4.0.3\", \"matchCriteriaId\": \"D5152AE7-9D5D-46D8-AC74-11CADDA2B366\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"8.4.0.4\", \"versionEndExcluding\": \"8.5.0.0\", \"matchCriteriaId\": \"C4420558-9318-4E4C-B607-952F2B9B95E3\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"A remote code execution vulnerability is present in network-listening components in some versions of ArubaOS. An attacker with the ability to transmit specially-crafted IP traffic to a mobility controller could exploit this vulnerability and cause a process crash or to execute arbitrary code within the underlying operating system with full system privileges. Such an attack could lead to complete system compromise. The ability to transmit traffic to an IP interface on the mobility controller is required to carry out an attack. The attack leverages the PAPI protocol (UDP port 8211). If the mobility controller is only bridging L2 traffic to an uplink and does not have an IP address that is accessible to the attacker, it cannot be attacked.\"}, {\"lang\": \"es\", \"value\": \"Una vulnerabilidad de ejecuci\\u00f3n de c\\u00f3digo remota est\\u00e1 presente en los componentes de escucha de red en algunas versiones de ArubaOS. Un atacante con la capacidad de transmitir tr\\u00e1fico IP especialmente dise\\u00f1ado hacia un controlador de movilidad podr\\u00eda explotar esta vulnerabilidad y causar un bloqueo del proceso o ejecutar c\\u00f3digo arbitrario dentro del sistema operativo subyacente con todos los privilegios del sistema. Tal y como un ataque podr\\u00eda conllevar a un compromiso total del sistema. La capacidad para transmitir tr\\u00e1fico hacia una interfaz IP en el controlador de movilidad es requerida para llevar a cabo un ataque. El ataque aprovecha el protocolo PAPI (puerto UDP 8211). Si el controlador de movilidad est\\u00e1 solo conectando el tr\\u00e1fico L2 a un enlace ascendente y no tiene una direcci\\u00f3n IP accesible para el atacante, no puede ser atacado.\"}]",
      "id": "CVE-2018-7081",
      "lastModified": "2024-11-21T04:11:37.137",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 5.9}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:M/Au:N/C:C/I:C/A:C\", \"baseScore\": 9.3, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"COMPLETE\", \"integrityImpact\": \"COMPLETE\", \"availabilityImpact\": \"COMPLETE\"}, \"baseSeverity\": \"HIGH\", \"exploitabilityScore\": 8.6, \"impactScore\": 10.0, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
      "published": "2019-09-13T17:15:10.913",
      "references": "[{\"url\": \"https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-004.txt\", \"source\": \"security-alert@hpe.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://x-c3ll.github.io/posts/CVE-2018-7081-RCE-ArubaOS/\", \"source\": \"security-alert@hpe.com\", \"tags\": [\"Exploit\", \"Third Party Advisory\"]}, {\"url\": \"https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-004.txt\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://x-c3ll.github.io/posts/CVE-2018-7081-RCE-ArubaOS/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Third Party Advisory\"]}]",
      "sourceIdentifier": "security-alert@hpe.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-20\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2018-7081\",\"sourceIdentifier\":\"security-alert@hpe.com\",\"published\":\"2019-09-13T17:15:10.913\",\"lastModified\":\"2024-11-21T04:11:37.137\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A remote code execution vulnerability is present in network-listening components in some versions of ArubaOS. An attacker with the ability to transmit specially-crafted IP traffic to a mobility controller could exploit this vulnerability and cause a process crash or to execute arbitrary code within the underlying operating system with full system privileges. Such an attack could lead to complete system compromise. The ability to transmit traffic to an IP interface on the mobility controller is required to carry out an attack. The attack leverages the PAPI protocol (UDP port 8211). If the mobility controller is only bridging L2 traffic to an uplink and does not have an IP address that is accessible to the attacker, it cannot be attacked.\"},{\"lang\":\"es\",\"value\":\"Una vulnerabilidad de ejecuci\u00f3n de c\u00f3digo remota est\u00e1 presente en los componentes de escucha de red en algunas versiones de ArubaOS. Un atacante con la capacidad de transmitir tr\u00e1fico IP especialmente dise\u00f1ado hacia un controlador de movilidad podr\u00eda explotar esta vulnerabilidad y causar un bloqueo del proceso o ejecutar c\u00f3digo arbitrario dentro del sistema operativo subyacente con todos los privilegios del sistema. Tal y como un ataque podr\u00eda conllevar a un compromiso total del sistema. La capacidad para transmitir tr\u00e1fico hacia una interfaz IP en el controlador de movilidad es requerida para llevar a cabo un ataque. El ataque aprovecha el protocolo PAPI (puerto UDP 8211). Si el controlador de movilidad est\u00e1 solo conectando el tr\u00e1fico L2 a un enlace ascendente y no tiene una direcci\u00f3n IP accesible para el atacante, no puede ser atacado.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:C/I:C/A:C\",\"baseScore\":9.3,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"COMPLETE\",\"integrityImpact\":\"COMPLETE\",\"availabilityImpact\":\"COMPLETE\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":8.6,\"impactScore\":10.0,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-20\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"6.4.4.21\",\"matchCriteriaId\":\"DDEB8052-8974-4F8B-9C64-DCE9D7C76753\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.5.0.0\",\"versionEndExcluding\":\"6.5.4.13\",\"matchCriteriaId\":\"16F5E9C2-A354-4F33-9D65-2A9FBDE6D085\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.0.0.0\",\"versionEndExcluding\":\"8.2.2.6\",\"matchCriteriaId\":\"DD6448CB-1D2B-47A4-9F70-0CDBE4F35858\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.3.0.0\",\"versionEndExcluding\":\"8.3.0.7\",\"matchCriteriaId\":\"E7F19B7F-1E7B-4C6E-AEB5-2755D10CA6CE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.4.0.0\",\"versionEndExcluding\":\"8.4.0.3\",\"matchCriteriaId\":\"D5152AE7-9D5D-46D8-AC74-11CADDA2B366\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.4.0.4\",\"versionEndExcluding\":\"8.5.0.0\",\"matchCriteriaId\":\"C4420558-9318-4E4C-B607-952F2B9B95E3\"}]}]}],\"references\":[{\"url\":\"https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-004.txt\",\"source\":\"security-alert@hpe.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://x-c3ll.github.io/posts/CVE-2018-7081-RCE-ArubaOS/\",\"source\":\"security-alert@hpe.com\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-004.txt\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://x-c3ll.github.io/posts/CVE-2018-7081-RCE-ArubaOS/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.