Vulnerability-Lookup

CERTFR-2023-AVI-0718

Vulnerability from certfr_avis - Published: 2023-09-07 - Updated: 2023-09-07

De multiples vulnérabilités ont été découvertes dans Aruba ArubaOS. Elles permettent à un attaquant de provoquer une exécution de code arbitraire et un contournement de la politique de sécurité.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

ArubaOS versions 10.4.x.x antérieures à 10.4.0.2
ArubaOS versions 8.11.x.x antérieures à 8.11.1.1
ArubaOS versions 8.10.x.x antérieures à 8.10.0.7
ArubaOS versions 8.6.x.x antérieures à 8.6.0.22

L'éditeur indique que les versions suivantes des logiciels ArubaOS et SD-WAM ne sont plus supportées :

ArubaOS 10.3.x.x, ArubaOS 8.9.x.x, ArubaOS 8.8.x.x, ArubaOS 8.7.x.x, ArubaOS 6.5.4.x, SD-WAN 8.7.0.0-2.3.0.x et SD-WAN 8.6.0.4-2.2.x.x

Impacted products

	Vendor	Product	Description

References

Title

Publication Time

Tags

Bulletin de sécurité Aruba du 06 septembre 2023

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cul\u003e \u003cli\u003eArubaOS versions 10.4.x.x ant\u00e9rieures \u00e0 10.4.0.2\u003c/li\u003e \u003cli\u003eArubaOS versions 8.11.x.x ant\u00e9rieures \u00e0 8.11.1.1\u003c/li\u003e \u003cli\u003eArubaOS versions 8.10.x.x ant\u00e9rieures \u00e0 8.10.0.7\u003c/li\u003e \u003cli\u003eArubaOS versions 8.6.x.x ant\u00e9rieures \u00e0 8.6.0.22\u003c/li\u003e \u003c/ul\u003e \u003cp\u003eL\u0027\u00e9diteur indique que les versions suivantes des logiciels ArubaOS et SD-WAM ne sont plus support\u00e9es :\u003c/p\u003e \u003cul\u003e \u003cli\u003eArubaOS 10.3.x.x, ArubaOS 8.9.x.x, ArubaOS 8.8.x.x, ArubaOS 8.7.x.x, ArubaOS 6.5.4.x, SD-WAN 8.7.0.0-2.3.0.x et SD-WAN 8.6.0.4-2.2.x.x\u003c/li\u003e \u003c/ul\u003e ",
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2023-38486",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-38486"
    },
    {
      "name": "CVE-2023-38484",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-38484"
    },
    {
      "name": "CVE-2023-38485",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-38485"
    }
  ],
  "initial_release_date": "2023-09-07T00:00:00",
  "last_revision_date": "2023-09-07T00:00:00",
  "links": [],
  "reference": "CERTFR-2023-AVI-0718",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2023-09-07T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Aruba ArubaOS.\nElles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code\narbitraire et un contournement de la politique de s\u00e9curit\u00e9.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Aruba ArubaOS",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Aruba du 06 septembre 2023",
      "url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-014.txt"
    }
  ]
}

CVE-2023-38484 (GCVE-0-2023-38484)

Vulnerability from cvelistv5 – Published: 2023-09-06 17:47 – Updated: 2024-09-30 16:07

Title

Multiple Buffer Overflow Vulnerabilities in BIOS Implementation of 9200 and 9000 Series Controllers and Gateways

Summary

Vulnerabilities exist in the BIOS implementation of Aruba 9200 and 9000 Series Controllers and Gateways that could allow an attacker to execute arbitrary code early in the boot sequence. An attacker could exploit this vulnerability to gain access to and change underlying sensitive information in the affected controller leading to complete system compromise.

Severity ?

8 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Assigner

hpe

References

URL

Tags

https://www.arubanetworks.com/assets/alert/ARUBA-…

Impacted products

	Vendor	Product	Version
	Hewlett Packard Enterprise (HPE)	9200 Series Mobility Controllers and SD-WAN Gateways, 9000 Series Mobility Controllers and SD-WAN Gateways	Affected: ArubaOS 10.4.x.x , ≤ <=10.4.0.1 (semver) Affected: ArubaOS 8.11.x.x , ≤ <=8.11.1.0 (semver) Affected: ArubaOS 8.10.x.x , ≤ <=8.10.0.6 (semver) Affected: ArubaOS 8.6.x.x , ≤ <=8.6.0.21 (semver)

Credits

Nicholas Starke of Aruba Threat Labs

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T17:39:13.618Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-014.txt"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:hewlett_packard_enterprise:9200_series_mobility_controllers_and_sd-wan_gateways_9000_series_mobility_controllers_and_sd-wan:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "9200_series_mobility_controllers_and_sd-wan_gateways_9000_series_mobility_controllers_and_sd-wan",
            "vendor": "hewlett_packard_enterprise",
            "versions": [
              {
                "lessThanOrEqual": "10.4.0.1",
                "status": "affected",
                "version": "aruba-os-10.4.x.x",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "8.11.1.0",
                "status": "affected",
                "version": "aruba-os-8.11.x.x",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "8.10.0.6",
                "status": "affected",
                "version": "aruba-os-8.10.x.x",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "8.6.0.21",
                "status": "affected",
                "version": "aruba-os-8.6.x.x",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-38484",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-30T15:56:14.032327Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-30T16:07:54.517Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "9200 Series Mobility Controllers and SD-WAN Gateways, 9000 Series Mobility Controllers and SD-WAN Gateways",
          "vendor": "Hewlett Packard Enterprise (HPE)",
          "versions": [
            {
              "lessThanOrEqual": "\u003c=10.4.0.1",
              "status": "affected",
              "version": "ArubaOS 10.4.x.x",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "\u003c=8.11.1.0",
              "status": "affected",
              "version": "ArubaOS 8.11.x.x",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "\u003c=8.10.0.6",
              "status": "affected",
              "version": "ArubaOS 8.10.x.x",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "\u003c=8.6.0.21",
              "status": "affected",
              "version": "ArubaOS 8.6.x.x",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Nicholas Starke of Aruba Threat Labs"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Vulnerabilities exist in the BIOS implementation of Aruba 9200 and 9000 Series Controllers and Gateways that could\u0026nbsp;allow an attacker to execute arbitrary code early in the boot\u0026nbsp;sequence. An attacker could exploit this vulnerability to\u0026nbsp;gain access to and change underlying sensitive information\u0026nbsp;in the affected controller leading to complete system\u0026nbsp;compromise."
            }
          ],
          "value": "Vulnerabilities exist in the BIOS implementation of Aruba 9200 and 9000 Series Controllers and Gateways that could\u00a0allow an attacker to execute arbitrary code early in the boot\u00a0sequence. An attacker could exploit this vulnerability to\u00a0gain access to and change underlying sensitive information\u00a0in the affected controller leading to complete system\u00a0compromise."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-09-06T17:47:18.689Z",
        "orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
        "shortName": "hpe"
      },
      "references": [
        {
          "url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-014.txt"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Multiple Buffer Overflow Vulnerabilities in BIOS Implementation of 9200 and 9000 Series Controllers and Gateways",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
    "assignerShortName": "hpe",
    "cveId": "CVE-2023-38484",
    "datePublished": "2023-09-06T17:47:18.689Z",
    "dateReserved": "2023-07-18T14:34:27.164Z",
    "dateUpdated": "2024-09-30T16:07:54.517Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-38486 (GCVE-0-2023-38486)

Vulnerability from cvelistv5 – Published: 2023-09-06 17:48 – Updated: 2024-09-26 19:51

Title

Hardware Root of Trust Bypass in 9200 and 9000 Series Controllers and Gateways

Summary

A vulnerability in the secure boot implementation on affected Aruba 9200 and 9000 Series Controllers and Gateways allows an attacker to bypass security controls which would normally prohibit unsigned kernel images from executing. An attacker can use this vulnerability to execute arbitrary runtime operating systems, including unverified and unsigned OS images.

Severity ?

7.7 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N

CWE

CWE-863 - Incorrect Authorization

Assigner

hpe

References

URL

Tags

https://www.arubanetworks.com/assets/alert/ARUBA-…

Impacted products

	Vendor	Product	Version
	Hewlett Packard Enterprise (HPE)	9200 Series Mobility Controllers and SD-WAN Gateways, 9000 Series Mobility Controllers and SD-WAN Gateways	Affected: ArubaOS 10.4.x.x , ≤ <=10.4.0.1 (semver) Affected: ArubaOS 8.11.x.x , ≤ <=8.11.1.0 (semver) Affected: ArubaOS 8.10.x.x , ≤ <=8.10.0.6 (semver) Affected: ArubaOS 8.6.x.x , ≤ <=8.6.0.21 (semver)

Credits

Nicholas Starke of Aruba Threat Labs

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T17:39:13.554Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-014.txt"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "affected",
            "product": "arubaos",
            "vendor": "arubanetworks",
            "versions": [
              {
                "lessThan": "8.6.0.22",
                "status": "affected",
                "version": "8.6.0.0",
                "versionType": "semver"
              },
              {
                "lessThan": "8.10.0.7",
                "status": "affected",
                "version": "8.10.0.0",
                "versionType": "semver"
              },
              {
                "lessThan": "8.11.1.1",
                "status": "affected",
                "version": "8.11.0.0",
                "versionType": "semver"
              },
              {
                "lessThan": "10.4.0.2",
                "status": "affected",
                "version": "10.4.0.0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-38486",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-26T19:38:37.378313Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-863",
                "description": "CWE-863 Incorrect Authorization",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-26T19:51:05.849Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "9200 Series Mobility Controllers and SD-WAN Gateways, 9000 Series Mobility Controllers and SD-WAN Gateways",
          "vendor": "Hewlett Packard Enterprise (HPE)",
          "versions": [
            {
              "lessThanOrEqual": "\u003c=10.4.0.1",
              "status": "affected",
              "version": "ArubaOS 10.4.x.x",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "\u003c=8.11.1.0",
              "status": "affected",
              "version": "ArubaOS 8.11.x.x",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "\u003c=8.10.0.6",
              "status": "affected",
              "version": "ArubaOS 8.10.x.x",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "\u003c=8.6.0.21",
              "status": "affected",
              "version": "ArubaOS 8.6.x.x",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Nicholas Starke of Aruba Threat Labs"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A vulnerability in the secure boot implementation on affected\u0026nbsp;Aruba 9200 and 9000 Series Controllers and Gateways allows\u0026nbsp;an attacker to bypass security controls which would normally\u0026nbsp;prohibit unsigned kernel images from executing. An attacker\u0026nbsp;can use this vulnerability to execute arbitrary runtime\u0026nbsp;operating systems, including unverified and unsigned OS\u0026nbsp;images."
            }
          ],
          "value": "A vulnerability in the secure boot implementation on affected\u00a0Aruba 9200 and 9000 Series Controllers and Gateways allows\u00a0an attacker to bypass security controls which would normally\u00a0prohibit unsigned kernel images from executing. An attacker\u00a0can use this vulnerability to execute arbitrary runtime\u00a0operating systems, including unverified and unsigned OS\u00a0images."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-09-06T17:48:38.025Z",
        "orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
        "shortName": "hpe"
      },
      "references": [
        {
          "url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-014.txt"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Hardware Root of Trust Bypass in 9200 and 9000 Series Controllers and Gateways",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
    "assignerShortName": "hpe",
    "cveId": "CVE-2023-38486",
    "datePublished": "2023-09-06T17:48:38.025Z",
    "dateReserved": "2023-07-18T14:34:27.165Z",
    "dateUpdated": "2024-09-26T19:51:05.849Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-38485 (GCVE-0-2023-38485)

Vulnerability from cvelistv5 – Published: 2023-09-06 17:47 – Updated: 2024-09-30 16:18

Title

Multiple Buffer Overflow Vulnerabilities in BIOS Implementation of 9200 and 9000 Series Controllers and Gateways

Summary

Severity ?

8 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Assigner

hpe

References

URL

Tags

https://www.arubanetworks.com/assets/alert/ARUBA-…

Impacted products

	Vendor	Product	Version
	Hewlett Packard Enterprise (HPE)	9200 Series Mobility Controllers and SD-WAN Gateways, 9000 Series Mobility Controllers and SD-WAN Gateways	Affected: ArubaOS 10.4.x.x , ≤ <=10.4.0.1 (semver) Affected: ArubaOS 8.11.x.x , ≤ <=8.11.1.0 (semver) Affected: ArubaOS 8.10.x.x , ≤ <=8.10.0.6 (semver) Affected: ArubaOS 8.6.x.x , ≤ <=8.6.0.21 (semver)

Credits

Nicholas Starke of Aruba Threat Labs

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T17:39:13.618Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-014.txt"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:hewlett_packard_enterprise:9200_series_mobility_controllers_and_sd-wan_gateways_9000_series_mobility_controllers_and_sd-wan:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "9200_series_mobility_controllers_and_sd-wan_gateways_9000_series_mobility_controllers_and_sd-wan",
            "vendor": "hewlett_packard_enterprise",
            "versions": [
              {
                "lessThanOrEqual": "8.11.1.0",
                "status": "affected",
                "version": "aruba-os_8.11.x.x",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "10.4.0.1",
                "status": "affected",
                "version": "aruba-os_10.4.x.x",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "8.10.0.6",
                "status": "affected",
                "version": "aruba-os_8.10.x.x",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "8.6.0.21",
                "status": "affected",
                "version": "aruba-os_8.11.x.x",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-38485",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-30T16:15:14.407752Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-30T16:18:23.308Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "9200 Series Mobility Controllers and SD-WAN Gateways, 9000 Series Mobility Controllers and SD-WAN Gateways",
          "vendor": "Hewlett Packard Enterprise (HPE)",
          "versions": [
            {
              "lessThanOrEqual": "\u003c=10.4.0.1",
              "status": "affected",
              "version": "ArubaOS 10.4.x.x",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "\u003c=8.11.1.0",
              "status": "affected",
              "version": "ArubaOS 8.11.x.x",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "\u003c=8.10.0.6",
              "status": "affected",
              "version": "ArubaOS 8.10.x.x",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "\u003c=8.6.0.21",
              "status": "affected",
              "version": "ArubaOS 8.6.x.x",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Nicholas Starke of Aruba Threat Labs"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Vulnerabilities exist in the BIOS implementation of Aruba 9200 and 9000 Series Controllers and Gateways that could\u0026nbsp;allow an attacker to execute arbitrary code early in the boot\u0026nbsp;sequence. An attacker could exploit this vulnerability to\u0026nbsp;gain access to and change underlying sensitive information\u0026nbsp;in the affected controller leading to complete system\u0026nbsp;compromise."
            }
          ],
          "value": "Vulnerabilities exist in the BIOS implementation of Aruba 9200 and 9000 Series Controllers and Gateways that could\u00a0allow an attacker to execute arbitrary code early in the boot\u00a0sequence. An attacker could exploit this vulnerability to\u00a0gain access to and change underlying sensitive information\u00a0in the affected controller leading to complete system\u00a0compromise."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-09-06T17:47:29.963Z",
        "orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
        "shortName": "hpe"
      },
      "references": [
        {
          "url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-014.txt"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Multiple Buffer Overflow Vulnerabilities in BIOS Implementation of 9200 and 9000 Series Controllers and Gateways",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
    "assignerShortName": "hpe",
    "cveId": "CVE-2023-38485",
    "datePublished": "2023-09-06T17:47:29.963Z",
    "dateReserved": "2023-07-18T14:34:27.165Z",
    "dateUpdated": "2024-09-30T16:18:23.308Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CERTFR-2023-AVI-0718

Solution

CVE-2023-38484 (GCVE-0-2023-38484)

CVE-2023-38486 (GCVE-0-2023-38486)

CVE-2023-38485 (GCVE-0-2023-38485)

Tags

Sightings

Nomenclature