CVE-2018-7081

{"id": "CVE-2018-7081", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2019-09-13T17:15:10.913", "references": [{"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-004.txt", "tags": ["Vendor Advisory"], "source": "security-alert@hpe.com"}, {"url": "https://x-c3ll.github.io/posts/CVE-2018-7081-RCE-ArubaOS/", "tags": ["Exploit", "Third Party Advisory"], "source": "security-alert@hpe.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "A remote code execution vulnerability is present in network-listening components in some versions of ArubaOS. An attacker with the ability to transmit specially-crafted IP traffic to a mobility controller could exploit this vulnerability and cause a process crash or to execute arbitrary code within the underlying operating system with full system privileges. Such an attack could lead to complete system compromise. The ability to transmit traffic to an IP interface on the mobility controller is required to carry out an attack. The attack leverages the PAPI protocol (UDP port 8211). If the mobility controller is only bridging L2 traffic to an uplink and does not have an IP address that is accessible to the attacker, it cannot be attacked."}, {"lang": "es", "value": "Una vulnerabilidad de ejecuci\u00f3n de c\u00f3digo remota est\u00e1 presente en los componentes de escucha de red en algunas versiones de ArubaOS. Un atacante con la capacidad de transmitir tr\u00e1fico IP especialmente dise\u00f1ado hacia un controlador de movilidad podr\u00eda explotar esta vulnerabilidad y causar un bloqueo del proceso o ejecutar c\u00f3digo arbitrario dentro del sistema operativo subyacente con todos los privilegios del sistema. Tal y como un ataque podr\u00eda conllevar a un compromiso total del sistema. La capacidad para transmitir tr\u00e1fico hacia una interfaz IP en el controlador de movilidad es requerida para llevar a cabo un ataque. El ataque aprovecha el protocolo PAPI (puerto UDP 8211). Si el controlador de movilidad est\u00e1 solo conectando el tr\u00e1fico L2 a un enlace ascendente y no tiene una direcci\u00f3n IP accesible para el atacante, no puede ser atacado."}], "lastModified": "2019-09-16T14:11:31.987", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DDEB8052-8974-4F8B-9C64-DCE9D7C76753", "versionEndExcluding": "6.4.4.21"}, {"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "16F5E9C2-A354-4F33-9D65-2A9FBDE6D085", "versionEndExcluding": "6.5.4.13", "versionStartIncluding": "6.5.0.0"}, {"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DD6448CB-1D2B-47A4-9F70-0CDBE4F35858", "versionEndExcluding": "8.2.2.6", "versionStartIncluding": "8.0.0.0"}, {"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E7F19B7F-1E7B-4C6E-AEB5-2755D10CA6CE", "versionEndExcluding": "8.3.0.7", "versionStartIncluding": "8.3.0.0"}, {"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D5152AE7-9D5D-46D8-AC74-11CADDA2B366", "versionEndExcluding": "8.4.0.3", "versionStartIncluding": "8.4.0.0"}, {"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C4420558-9318-4E4C-B607-952F2B9B95E3", "versionEndExcluding": "8.5.0.0", "versionStartIncluding": "8.4.0.4"}], "operator": "OR"}]}], "sourceIdentifier": "security-alert@hpe.com"}