Aruba Mobility Controller TLS Session Renegotiation Plaintext Injection

Secunia ID	SA38484
CVE-ID	CVE-2009-3555
Release Date	09 Feb 2010
Last Change	27 Sep 2010
Criticality	Less Critical
Solution Status	Vendor Patch
Where	From remote
Impact	Manipulation of data This includes vulnerabilities where a user or a remote attacker can manipulate local data on a system, but not necessarily be able to gain escalated privileges or system access. The most frequent type of vulnerabilities with this impact are SQL-injection vulnerabilities, where a malicious user or person can manipulate SQL queries.
Description	Aruba Networks has acknowledged a vulnerability in Aruba Mobility Controller, which can be exploited by malicious people to manipulate certain data. The vulnerability is caused due to an error in the TLS protocol while handling session re-negotiations. For more information: SA37291 The vulnerability is reported in ArubaOS versions 2.5.6.x, 3.3.2.x, 3.3.3.x, 3.4.0.x, 3.4.1.x, RN 3.1.x, 3.3.2.x-FIPS, and 2.4.8.x-FIPS.
Solution	Apply the patches 2.5.6.24, 3.3.2.23, 3.3.3.2, 3.4.0.7, 3.4.1.1, or RN 3.1.4.
Original Advisory	http://www.arubanetworks.com/support/alerts/aid-020810.asc