CVE-2018-7081 (GCVE-0-2018-7081)

Vulnerability from cvelistv5 – Published: 2019-09-13 16:49 – Updated: 2024-08-05 06:17
VLAI?
Summary
A remote code execution vulnerability is present in network-listening components in some versions of ArubaOS. An attacker with the ability to transmit specially-crafted IP traffic to a mobility controller could exploit this vulnerability and cause a process crash or to execute arbitrary code within the underlying operating system with full system privileges. Such an attack could lead to complete system compromise. The ability to transmit traffic to an IP interface on the mobility controller is required to carry out an attack. The attack leverages the PAPI protocol (UDP port 8211). If the mobility controller is only bridging L2 traffic to an uplink and does not have an IP address that is accessible to the attacker, it cannot be attacked.
Severity ?
No CVSS data available.
CWE
  • remote code execution
Assigner
hpe
References
Impacted products
Vendor Product Version
n/a Aruba Mobility Controllers Affected: Aruba Mobility Controller firmware (ArubaOS) 6.x prior to 6.4.4.21 6.5.x prior to 6.5.4.13 8.x prior to 8.2.2.6 8.3.0.x prior to 8.3.0.7, 8.4.0.x and prior to 8.4.0.3
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T06:17:17.386Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-004.txt"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://x-c3ll.github.io/posts/CVE-2018-7081-RCE-ArubaOS/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Aruba Mobility Controllers",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Aruba Mobility Controller firmware (ArubaOS) 6.x prior to 6.4.4.21 6.5.x prior to 6.5.4.13  8.x prior to 8.2.2.6  8.3.0.x prior to 8.3.0.7, 8.4.0.x and prior to 8.4.0.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A remote code execution vulnerability is present in network-listening components in some versions of ArubaOS. An attacker with the ability to transmit specially-crafted IP traffic to a mobility controller could exploit this vulnerability and cause a process crash or to execute arbitrary code within the underlying operating system with full system privileges. Such an attack could lead to complete system compromise. The ability to transmit traffic to an IP interface on the mobility controller is required to carry out an attack. The attack leverages the PAPI protocol (UDP port 8211). If the mobility controller is only bridging L2 traffic to an uplink and does not have an IP address that is accessible to the attacker, it cannot be attacked."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "remote code execution",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-09-13T19:00:10",
        "orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
        "shortName": "hpe"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-004.txt"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://x-c3ll.github.io/posts/CVE-2018-7081-RCE-ArubaOS/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-alert@hpe.com",
          "ID": "CVE-2018-7081",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Aruba Mobility Controllers",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Aruba Mobility Controller firmware (ArubaOS) 6.x prior to 6.4.4.21 6.5.x prior to 6.5.4.13  8.x prior to 8.2.2.6  8.3.0.x prior to 8.3.0.7, 8.4.0.x and prior to 8.4.0.3"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A remote code execution vulnerability is present in network-listening components in some versions of ArubaOS. An attacker with the ability to transmit specially-crafted IP traffic to a mobility controller could exploit this vulnerability and cause a process crash or to execute arbitrary code within the underlying operating system with full system privileges. Such an attack could lead to complete system compromise. The ability to transmit traffic to an IP interface on the mobility controller is required to carry out an attack. The attack leverages the PAPI protocol (UDP port 8211). If the mobility controller is only bridging L2 traffic to an uplink and does not have an IP address that is accessible to the attacker, it cannot be attacked."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "remote code execution"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-004.txt",
              "refsource": "CONFIRM",
              "url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-004.txt"
            },
            {
              "name": "https://x-c3ll.github.io/posts/CVE-2018-7081-RCE-ArubaOS/",
              "refsource": "MISC",
              "url": "https://x-c3ll.github.io/posts/CVE-2018-7081-RCE-ArubaOS/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
    "assignerShortName": "hpe",
    "cveId": "CVE-2018-7081",
    "datePublished": "2019-09-13T16:49:09",
    "dateReserved": "2018-02-15T00:00:00",
    "dateUpdated": "2024-08-05T06:17:17.386Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"6.4.4.21\", \"matchCriteriaId\": \"DDEB8052-8974-4F8B-9C64-DCE9D7C76753\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.5.0.0\", \"versionEndExcluding\": \"6.5.4.13\", \"matchCriteriaId\": \"16F5E9C2-A354-4F33-9D65-2A9FBDE6D085\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"8.0.0.0\", \"versionEndExcluding\": \"8.2.2.6\", \"matchCriteriaId\": \"DD6448CB-1D2B-47A4-9F70-0CDBE4F35858\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"8.3.0.0\", \"versionEndExcluding\": \"8.3.0.7\", \"matchCriteriaId\": \"E7F19B7F-1E7B-4C6E-AEB5-2755D10CA6CE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"8.4.0.0\", \"versionEndExcluding\": \"8.4.0.3\", \"matchCriteriaId\": \"D5152AE7-9D5D-46D8-AC74-11CADDA2B366\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"8.4.0.4\", \"versionEndExcluding\": \"8.5.0.0\", \"matchCriteriaId\": \"C4420558-9318-4E4C-B607-952F2B9B95E3\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"A remote code execution vulnerability is present in network-listening components in some versions of ArubaOS. An attacker with the ability to transmit specially-crafted IP traffic to a mobility controller could exploit this vulnerability and cause a process crash or to execute arbitrary code within the underlying operating system with full system privileges. Such an attack could lead to complete system compromise. The ability to transmit traffic to an IP interface on the mobility controller is required to carry out an attack. The attack leverages the PAPI protocol (UDP port 8211). If the mobility controller is only bridging L2 traffic to an uplink and does not have an IP address that is accessible to the attacker, it cannot be attacked.\"}, {\"lang\": \"es\", \"value\": \"Una vulnerabilidad de ejecuci\\u00f3n de c\\u00f3digo remota est\\u00e1 presente en los componentes de escucha de red en algunas versiones de ArubaOS. Un atacante con la capacidad de transmitir tr\\u00e1fico IP especialmente dise\\u00f1ado hacia un controlador de movilidad podr\\u00eda explotar esta vulnerabilidad y causar un bloqueo del proceso o ejecutar c\\u00f3digo arbitrario dentro del sistema operativo subyacente con todos los privilegios del sistema. Tal y como un ataque podr\\u00eda conllevar a un compromiso total del sistema. La capacidad para transmitir tr\\u00e1fico hacia una interfaz IP en el controlador de movilidad es requerida para llevar a cabo un ataque. El ataque aprovecha el protocolo PAPI (puerto UDP 8211). Si el controlador de movilidad est\\u00e1 solo conectando el tr\\u00e1fico L2 a un enlace ascendente y no tiene una direcci\\u00f3n IP accesible para el atacante, no puede ser atacado.\"}]",
      "id": "CVE-2018-7081",
      "lastModified": "2024-11-21T04:11:37.137",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 5.9}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:M/Au:N/C:C/I:C/A:C\", \"baseScore\": 9.3, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"COMPLETE\", \"integrityImpact\": \"COMPLETE\", \"availabilityImpact\": \"COMPLETE\"}, \"baseSeverity\": \"HIGH\", \"exploitabilityScore\": 8.6, \"impactScore\": 10.0, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
      "published": "2019-09-13T17:15:10.913",
      "references": "[{\"url\": \"https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-004.txt\", \"source\": \"security-alert@hpe.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://x-c3ll.github.io/posts/CVE-2018-7081-RCE-ArubaOS/\", \"source\": \"security-alert@hpe.com\", \"tags\": [\"Exploit\", \"Third Party Advisory\"]}, {\"url\": \"https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-004.txt\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://x-c3ll.github.io/posts/CVE-2018-7081-RCE-ArubaOS/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Third Party Advisory\"]}]",
      "sourceIdentifier": "security-alert@hpe.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-20\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2018-7081\",\"sourceIdentifier\":\"security-alert@hpe.com\",\"published\":\"2019-09-13T17:15:10.913\",\"lastModified\":\"2024-11-21T04:11:37.137\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A remote code execution vulnerability is present in network-listening components in some versions of ArubaOS. An attacker with the ability to transmit specially-crafted IP traffic to a mobility controller could exploit this vulnerability and cause a process crash or to execute arbitrary code within the underlying operating system with full system privileges. Such an attack could lead to complete system compromise. The ability to transmit traffic to an IP interface on the mobility controller is required to carry out an attack. The attack leverages the PAPI protocol (UDP port 8211). If the mobility controller is only bridging L2 traffic to an uplink and does not have an IP address that is accessible to the attacker, it cannot be attacked.\"},{\"lang\":\"es\",\"value\":\"Una vulnerabilidad de ejecuci\u00f3n de c\u00f3digo remota est\u00e1 presente en los componentes de escucha de red en algunas versiones de ArubaOS. Un atacante con la capacidad de transmitir tr\u00e1fico IP especialmente dise\u00f1ado hacia un controlador de movilidad podr\u00eda explotar esta vulnerabilidad y causar un bloqueo del proceso o ejecutar c\u00f3digo arbitrario dentro del sistema operativo subyacente con todos los privilegios del sistema. Tal y como un ataque podr\u00eda conllevar a un compromiso total del sistema. La capacidad para transmitir tr\u00e1fico hacia una interfaz IP en el controlador de movilidad es requerida para llevar a cabo un ataque. El ataque aprovecha el protocolo PAPI (puerto UDP 8211). Si el controlador de movilidad est\u00e1 solo conectando el tr\u00e1fico L2 a un enlace ascendente y no tiene una direcci\u00f3n IP accesible para el atacante, no puede ser atacado.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:C/I:C/A:C\",\"baseScore\":9.3,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"COMPLETE\",\"integrityImpact\":\"COMPLETE\",\"availabilityImpact\":\"COMPLETE\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":8.6,\"impactScore\":10.0,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-20\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"6.4.4.21\",\"matchCriteriaId\":\"DDEB8052-8974-4F8B-9C64-DCE9D7C76753\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.5.0.0\",\"versionEndExcluding\":\"6.5.4.13\",\"matchCriteriaId\":\"16F5E9C2-A354-4F33-9D65-2A9FBDE6D085\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.0.0.0\",\"versionEndExcluding\":\"8.2.2.6\",\"matchCriteriaId\":\"DD6448CB-1D2B-47A4-9F70-0CDBE4F35858\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.3.0.0\",\"versionEndExcluding\":\"8.3.0.7\",\"matchCriteriaId\":\"E7F19B7F-1E7B-4C6E-AEB5-2755D10CA6CE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.4.0.0\",\"versionEndExcluding\":\"8.4.0.3\",\"matchCriteriaId\":\"D5152AE7-9D5D-46D8-AC74-11CADDA2B366\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.4.0.4\",\"versionEndExcluding\":\"8.5.0.0\",\"matchCriteriaId\":\"C4420558-9318-4E4C-B607-952F2B9B95E3\"}]}]}],\"references\":[{\"url\":\"https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-004.txt\",\"source\":\"security-alert@hpe.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://x-c3ll.github.io/posts/CVE-2018-7081-RCE-ArubaOS/\",\"source\":\"security-alert@hpe.com\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-004.txt\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://x-c3ll.github.io/posts/CVE-2018-7081-RCE-ArubaOS/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.