CVE-2018-7058 : Security Advisory and Response

Aruba ClearPass, all versions of 6.6.x prior to 6.6.9, are affected by an authentication bypass vulnerability that allows attackers to gain administrator privileges on the system.

Understanding CVE-2018-7058

An authentication bypass vulnerability in Aruba ClearPass prior to specific versions exposes the system to potential compromise.

What is CVE-2018-7058?

An authentication bypass vulnerability in Aruba ClearPass allows attackers to obtain administrator privileges through specific web interfaces.
The vulnerability affects versions 6.6.x prior to 6.6.9 and 6.7.x prior to 6.7.1.

The Impact of CVE-2018-7058

Exploiting this vulnerability enables attackers to gain unauthorized access and potentially compromise the system.
ClearPass web interfaces, including administrative, guest captive portal, and API, are specifically vulnerable.

Technical Details of CVE-2018-7058

Aruba ClearPass vulnerability details and affected systems.

Vulnerability Description

An authentication bypass vulnerability in Aruba ClearPass versions prior to 6.6.9.
Attackers can exploit this flaw to elevate their privileges to administrator level.

Affected Systems and Versions

Product: Aruba ClearPass
Vendor: Hewlett Packard Enterprise
Vulnerable Versions: 6.6.x before 6.6.9 and 6.7.x before 6.7.1

Exploitation Mechanism

The vulnerability is present in ClearPass web interfaces, such as administrative, guest captive portal, and API.
Systems that expose these interfaces to untrusted users are at higher risk.

Mitigation and Prevention

Steps to mitigate and prevent the CVE-2018-7058 vulnerability.

Immediate Steps to Take

Update Aruba ClearPass to versions 6.6.9 or 6.7.1 to patch the authentication bypass vulnerability.
Restrict access to ClearPass web interfaces to trusted users only.

Long-Term Security Practices

Regularly monitor and audit access to ClearPass systems.
Implement network segmentation to limit exposure of critical systems.

Patching and Updates

Apply security patches and updates provided by Hewlett Packard Enterprise to address the vulnerability.