CVE-2023-35979

Published: Jul 5, 2023Modified: Nov 21, 2024

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

There is an unauthenticated buffer overflow vulnerability in the process controlling the ArubaOS web-based management interface. Successful exploitation of this vulnerability results in a Denial-of-Service (DoS) condition affecting the web-based management interface of the controller.

Affected (4)

Products: Arubanetworks: Arubaos

Arubanetworks

1 product

Arubaos

Configuration A

4 vulnerable · 13 platform

Vulnerable Software	Affected Versions
Arubanetworks Arubaos	From 10.4.0.0 to 10.4.0.2
Arubanetworks Arubaos	From 6.5.4.0 to 8.6.0.21
Arubanetworks Arubaos	From 8.11.0.0 to 8.11.1.1
Arubanetworks Arubaos	From 8.7.0.0 to 8.10.0.7

Running on/with	Platform Versions
Arubanetworks Mc Va 10	All versions
Arubanetworks Mc Va 1k	All versions
Arubanetworks Mc Va 250	All versions
Arubanetworks Mc Va 50	All versions
Arubanetworks Mcr Hw 10k	All versions
Arubanetworks Mcr Hw 1k	All versions
Arubanetworks Mcr Hw 5k	All versions
Arubanetworks Mcr Va 10k	All versions
Arubanetworks Mcr Va 1k	All versions
Arubanetworks Mcr Va 50	All versions
Arubanetworks Mcr Va 500	All versions
Arubanetworks Mcr Va 5k	All versions
Arubanetworks Sd Wan	All versions

Related CWEs

CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.

References (2)

https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-008.txt

Source: security-alert@hpe.com

Vendor Advisory

https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-008.txt

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.