Saint TLStorm 2, Storm in the Switches

Patron of network switches, misused TLS libraries, and captive portals nobody looks at.

Life

On 3 May 2022 Armis revealed the second act of TLStorm: several Aruba and Avaya switches used the NanoSSL TLS library incorrectly, and a few malformed messages, for instance to the captive portal or the RADIUS server, let an attacker run code on the switch. From the switch one could then step out of the guest network and wander wherever one pleased.

Prayer

O Saint TLStorm, who blows through the cables of our switches, let our devices read a message before trusting it. Amen.

How to celebrate

Celebrated by updating switch firmware and truly separating the guest network from the house.

The switch is silent, but it hears everything.

Technical record

Disclosed on: May 3 2022
CVE: CVE-2022-23677 CVE-2022-23676 CVE-2022-29860 CVE-2022-29861
Product: ArubaOS-Switch Devices

A remote execution of arbitrary code vulnerability was discovered in ArubaOS-Switch Devices version(s): ArubaOS-Switch 15.xx.xxxx: All versions; ArubaOS-Switch 16.01.xxxx: All versions; ArubaOS-Switch 16.02.xxxx: K.16.02.0033 and below; ArubaOS-Switch 16.03.xxxx: All versions; ArubaOS-Switch 16.04.xxxx: All versions; ArubaOS-Switch 16.05.xxxx: All versions; ArubaOS-Switch 16.06.xxxx: All versions; ArubaOS-Switch 16.07.xxxx: All versions; ArubaOS-Switch 16.08.xxxx: KB/WB/WC/YA/YB/YC.16.08.0024 and below; ArubaOS-Switch 16.09.xxxx: KB/WB/WC/YA/YB/YC.16.09.0019 and below; ArubaOS-Switch 16.10.xxxx: KB/WB/WC/YA/YB/YC.16.10.0019 and below; ArubaOS-Switch 16.11.xxxx: KB/WB/WC/YA/YB/YC.16.11.0003 and below. Aruba has released upgrades for ArubaOS-Switch Devices that address these security vulnerabilities.

Sources: armis.com · media.armis.com

Canonized by Pope Follina I

Saint TLStorm 2, Storm in the Switches

Life

Prayer

How to celebrate

Technical record

Related saints

Sharing the feast day

The “storm” family

Same year: 2022