CVE-2022-23678

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Aruba Product Security Advisory =============================== Advisory ID: ARUBA-PSA-2022-011 CVE: CVE-2022-23678 Publication Date: 2022-Jul-26 Last Update: 2022-Aug-19 Status: Confirmed Severity: Medium Revision: 2 Title ===== Vulnerability in Aruba Virtual Intranet Access (VIA) Overview ======== Aruba has released an update to Aruba Virtual Intranet Access (VIA) that addresses a security vulnerability in the Aruba VIA client for the Microsoft Windows operating system. This vulnerability does not affect Aruba VIA clients for other operating systems. Affected Products ================= This vulnerability affects Aruba Virtual Intranet Access (VIA) running the following versions unless specifically noted otherwise in the details section: - Aruba Virtual Intranet Access (VIA) for Windows: - All versions lower than VIA 4.3.0 build 2208101 Updating Aruba Virtual Intranet Access (VIA) to a version listed in the Resolution section at the end of this advisory will resolve all issues in the details section. Details ======= Sensitive Information Disclosure in Aruba VIA Client for Microsoft Windows Operating System via Privileged Network Position (CVE-2022-23678) --------------------------------------------------------------------- A vulnerability exists in the Aruba VIA client for Microsoft Windows operating system client communications that could allow for an attacker in a privileged network position to intercept sensitive information. Internal Reference: ATLCP-200 Severity: Medium CVSSv3.x Overall Score: 6.5 CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N Discovery: This vulnerability was discovered and reported by Mr. Ka-Lok Wu, Mr. Ngai-Man Poon, and Prof. Sze-Yiu Chau of the Department of Information Engineering, Chinese University of Hong Kong. Resolution ========== The vulnerability contained in this advisory can be addressed by upgrading to the Aruba Virtual Intranet Access (VIA) version listed below - Aruba Virtual Intranet Access (VIA) for Windows: - Version 4.3.0 build 2208101 released August 15th, 2022 and above - Version 4.4.0 and above Aruba does not evaluate or patch Aruba Virtual Intranet Access (VIA) versions that have reached their End of Support (EoS) milestone. For more information about Aruba’s End of Support policy visit: https://www.arubanetworks.com/support-services/end-of-life/ Workaround ========== There is no workaround for this vulnerability. Exploitation and Public Discussion ================================== Aruba is not aware of any public discussion or exploit code that targets this specific vulnerability as of the release date of the advisory. Revision History ================ Revision 1 / 2022-Jul-26 / Initial release Revision 2 / 2022-Aug-19 / Added resolution information 4.3.0 build 2208101 released August 15th 2022 and rewrote resolution and affected sections Aruba SIRT Security Procedures ============================== Complete information on reporting security vulnerabilities in Aruba Networks products and obtaining assistance with security incidents is available at: https://www.arubanetworks.com/support-services/security-bulletins/ For reporting *NEW* Aruba Networks security issues, email can be sent to aruba-sirt(at)hpe.com. For sensitive information we encourage the use of PGP encryption. Our public keys can be found at: https://www.arubanetworks.com/support-services/security-bulletins/ © Copyright 2022 by Aruba, a Hewlett Packard Enterprise company. This advisory may be redistributed freely after the release date given at the top of the text, provided that the redistributed copies are complete and unmodified, including all data and version information. -----BEGIN PGP SIGNATURE----- iQFLBAEBCAA1FiEEMd5pP5EnbG7Y0fo5mP4JykWFhtkFAmL89lkXHHNpcnRAYXJ1 YmFuZXR3b3Jrcy5jb20ACgkQmP4JykWFhtm16wf9HXVeFqDT5tpcPFQYqeIAC2dQ 2V+zx2n+c4CMesYaNDuEffaiVX0ds0jXEGGEYQaVMS3zHJTUj+1rIJ+2Z0d4gdd7 NT4SktkNiVKaJ5l3HqLM0mYDIbH5yGGGuekVbQxscam605acb9b6ihPIHFpHAmL/ kGEK2y2b3gjYELDJm4L+6jIDz+fVARVkYn6leZs0HodE4ZP2aCCUmciQdRw8z3A/ e5ZED5SOGo7N/xcFHLYRyhxs8ELAKynEJYqxAMcPPrgJ/5xyxEOQRmfnB7AKXmeo szIJ1vxDXvppPTyBkBOJfZ/YEhHaE2QfSSQo6J+f5d/pJ3/iEuG1Ua/EDGU0PA== =cPqX -----END PGP SIGNATURE-----