#VU8914 Information disclosure in ArubaOS - CVE-2017-9000

Vulnerability identifier: #VU8914

Vulnerability risk: Low

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-9000

CWE-ID: CWE-284

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
ArubaOS
Operating systems & Components / Operating system

Vendor: Aruba Networks

Description
The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The weakness exists due to improper access control. A remote attacker with network access to an Aruba mobility controller on TCP port 8080 or 8081 can access files which could contain passwords, keys, and other sensitive information.

Mitigation
The vulnerability is addressed in the following versions: 6.3.1.25, 6.4.4.16, 6.5.1.9, 6.5.3.3, 6.5.4.2, 8.1.0.4.

Vulnerable software versions

ArubaOS: 6.4.4.1 - 8.1.0.2

---

External links
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-006.txt

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.