Network Management

 View Only
last person joined: yesterday 

Keep an informative eye on your network with HPE Aruba Networking network management solutions
Back to discussions
Expand all | Collapse all

Aruba CX Switches and Open SSH version 8.7/8.8?

This thread has been viewed 2 times

  • 1.  Aruba CX Switches and Open SSH version 8.7/8.8?

    Posted Aug 02, 2024 02:08 PM

    I have a customer who sent me the following message a few minutes ago.

    "My security company sent the following about the Aruba switches. Is there an update for this?

     
    This vulnerability impacts versions 8.7/8.8 of the OpenSSH secure networking suite which can lead to a remote code execution. While these internal IPs do not appear to be externally facing, to err the side of caution, we recommend upgrading to the latest secure OpenSSH release."

    I was provided with a list of 5 switches that are reportedly running a vulnerable version of OpenSSH.  In each case, the switches are running either 10.10.1030 or 10.10.1070, and they are running SSH version 2.0.  The customer also has switches running those same firmware versions that were not listed as being vulnerable.  My gut tells me that the customer's security scan is picking up a red herring, but I figure it's worth checking here before I brush it off.  I have advised the customer that we should upgrade the switches to 10.13.1010, but have yet to receive approval.  However, the data I have thus far collected makes me suspicious that this is a firmware issue.  Any thoughts?


  • 2.  RE: Aruba CX Switches and Open SSH version 8.7/8.8?

    MVP GURU
    Posted Aug 02, 2024 02:26 PM
    Hi, have a look to HPE Aruba Networking Product Security Advisory HPESBNW04669 about CVE-2024-6387 "Unauthenticated Remote Code Execution vulnerability in OpenSSH's Server (RegreSSHion)" (Publication Date: 2024-Jul-10, Last Updated: 2024-Jul-31, Status: Confirmed, Severity: High, Revision: 2).

    https://csaf.arubanetworks.com/2024/hpe_aruba_networking_-_hpesbnw04669.txt

    To recap:

    Affected ArubaOS-CX Switches:
    - 10.14.0006 and below
    - 10.13.1030 and below
    - 10.12.1050 and below
    - 10.11.1070 and below
    - 10.10.1130 and below
    - Software Releases prior to ArubaOS-CX version 10.10.xxxx are not affected but are currently End of Support

    Fixed ArubaOS-CX Switches:
    - 10.14.0007 and above
    - 10.13.1031 and above
    - 10.10.1131 and above



    Original Message