Lucene search

[email protected]CVE-2008-7095

HistoryAug 27, 2009 - 6:30 p.m.

CVE-2008-7095

2009-08-2718:30:00

CWE-264

[email protected]

web.nvd.nist.gov

arubaos

aruba mobility controller

snmp

remote attackers

community strings

snmpv3

security vulnerability

7.8 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:C/I:N/A:N

6.8 Medium

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

68.5%

JSON

The SNMP daemon in ArubaOS 3.3.2.6 in Aruba Mobility Controller does not restrict SNMP access, which allows remote attackers to (1) read all SNMP community strings via SNMP-COMMUNITY-MIB::snmpCommunityName (1.3.6.1.6.3.18.1.1.1.2) or SNMP-VIEW-BASED-ACM-MIB::vacmGroupName (1.3.6.1.6.3.16.1.2.1.3) with knowledge of one community string, and (2) read SNMPv3 user names via SNMP-USER-BASED-SM-MIB or SNMP-VIEW-BASED-ACM-MIB.

Affected configurations

NVD

Node

arubanetworksaruba_mobility_controller

AND

arubanetworksarubaosMatch3.3.2.6

CPENameOperatorVersion
arubanetworks:aruba_mobility_controllerarubanetworks aruba mobility controllereq*
arubanetworks:arubaosarubanetworks arubaoseq3.3.2.6

CPE	Name	Operator	Version
arubanetworks:aruba_mobility_controller	arubanetworks aruba mobility controller	eq	*
arubanetworks:arubaos	arubanetworks arubaos	eq	3.3.2.6

References

osvdb.org/51916

www.securityfocus.com/archive/1/498033/100/0/threaded

www.securityfocus.com/bid/32102

7.8 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:C/I:N/A:N

6.8 Medium

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

68.5%

JSON

Related for CVE-2008-7095

prion1 cvelist1 nvd1