CVE-2017-9001
First published: Mon Aug 06 2018(Updated: )
Aruba ClearPass 6.6.3 and later includes a feature called "SSH Lockout", which causes ClearPass to lock accounts with too many login failures through SSH. When this feature is enabled, an unauthenticated remote command execution vulnerability is present which could allow an unauthenticated user to execute arbitrary commands on the underlying operating system with "root" privilege level. This vulnerability is only present when a specific feature has been enabled. The SSH Lockout feature is not enabled by default, so only systems which have enabled this feature are vulnerable.
Credit: security-alert@hpe.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Hp Aruba Clearpass Policy Manager | >=6.6.3<6.6.8 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is CVE-2017-9001?
CVE-2017-9001 is a vulnerability in Aruba ClearPass 6.6.3 and later that enables an unauthenticated remote command execution due to the SSH Lockout feature.
How does CVE-2017-9001 affect Aruba ClearPass Policy Manager?
CVE-2017-9001 affects Aruba ClearPass Policy Manager versions between 6.6.3 and 6.6.8, allowing for unauthenticated remote command execution through the SSH Lockout feature.
What is the severity of CVE-2017-9001?
CVE-2017-9001 has a severity rating of 8.1, which is considered critical.
How can I fix CVE-2017-9001 in Aruba ClearPass Policy Manager?
To fix CVE-2017-9001, it is recommended to upgrade Aruba ClearPass Policy Manager to a version beyond 6.6.8 or apply the necessary patches provided by Aruba Networks.
Where can I find more information about CVE-2017-9001?
More information about CVE-2017-9001 can be found in the advisory provided by Aruba Networks at https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-004.txt.
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/type
- collector/nvd-index
- vendor/hp
- canonical/hp aruba clearpass policy manager
- version/hp aruba clearpass policy manager/6.6.3