Controllerless Networks

Hi,

I was send the follwoing today

Advisory ID: ARUBA-PSA-2016-004
CVE: CVE-2016-2031
Publication Date: 2016-May-04
Status: Confirmed
Revision: 1

Please can someone explain the Aruba firmware release  pattern / naming convention.

The advisory says that Aruba Instant (all versions up to, but not including, 4.1.3.0 and 4.2.3.1) are affected but sorry to sound stupid but the current relased is 6.4.4.4-4.2.3.1_54637 and this is for 4.xxxx. Also when was the 'safe' version of Aruba instant firmware relased?

Jason

My guess is that the 4.x.x.x refers to the middle part of the full version number. I.e. 6.4.4.4-4.2.3.1_54637 = 4.2.3.1. And 6.4.4.4-4.2.3.1 is the latest release in the Early Deployment branch. 

But that still doesn't explain where 4.1.3.0 can be downloaded. The latest release in the General Availability branch is 6.4.2.6-4.1.1.12 (I.e. 4.1.1.12 if my theory is correct) and the Early Deployment branch only have 4.2.x.x versions.

The full Aruba Instant version numbers is built up like: <ArubaOS base version>-<Aruba Instant version>_<build number>.

The ArubaOS base version defines from which Controller release this Instant version has been derived, and is there for information purposes only; the same for the Build Number.

So in most cases you only take the middle part 4.x.x.x into account. 

Aruba Instant firmware is available without support contract from the 'Check new version' in the Maintenance tab in the virtual controller, or via the support website under Life time warranty software: http://support.arubanetworks.com/LifetimeWarrantySoftware/tabid/121/Default.aspx. At this moment 4.1.1.12 and 4.2.2.0 are the available versions.

Version 4.1.3.0 has not been released yet, you may work with Aruba TAC to get an estimated release date.

I'm sitting on 4.1.1.11 and have been checking for firmware since the bulletins have come out under Maintenance.  It won't pull any updates down.

You can update manually by URL.  What URL should we be using?

The lifetime warranty software available at the moment is here 4.2.2.0

http://support.arubanetworks.com/LifetimeWarrantySoftware/tabid/121/DMXModule/661/Default.aspx?EntryId=20388

4.1.3.0 now available under:

aruba instant>GA>current release

https://support.arubanetworks.com/DownloadSoftware/tabid/75/DMXModule/510/EntryId/16736/Default.aspx

In reference to the URL, I'm referring to the box on the Maintenance > Firmware page where it asks for URL for manual updating.

you can use HTTP, TFTP, FTP (anonymous only). from user guides:

Select the Image URL option. Select this option to obtain an image file from a TFTP, FTP, or HTTP URL.
n HTTP - http://<IP-address>/<image-file>. For example, http://<IP-address>/ArubaInstant_Orion_6.4.4.4-
4.2.3.0.0_xxxx
n TFTP - tftp://<IP-address>/<image-file>. For example, tftp://<IP-address>/ArubaInstant_Orion_6.4.4.4-
4.2.3.0.0_xxxx
n FTP - ftp://<IP-address>/<image-file>. For example, ftp://<IP-address>/ArubaInstant_Orion_6.4.4.4-
4.2.3.0.0_xxxx