Tlstorm 2.0: Critical Bugs Allow Remote Access To Enterprise Networks

TLStorm 2.0 has recently been discovered to contain critical bugs that can potentially enable unauthorized remote access to enterprise networks. Armis, a team of security analysts, has identified five vulnerabilities in Aruba and Avaya switches, specifically related to TLS communications. These vulnerabilities can be exploited by attackers, allowing them to gain unauthorized access to corporate networks and potentially steal confidential information. The vulnerabilities arise from the misuse of the widely-used TLS library, Mocana NanoSSL, affecting devices from various switch vendors. Aruba and Avaya switches are particularly susceptible to remote code execution (RCE) flaws that can be exploited via network channels. The impacted devices include Avaya ERS3500, ERS3600, ERS4900, and ERS5900 Series switches, as well as Aruba 5400R, 3810, 2920, 2930F, 2930M, 2530, and 2540 Series switches. Exploiting these RCE vulnerabilities can lead to breaches in network segmentation, data exfiltration, and the transmission of sensitive information to the internet. Organizations using Avaya and Aruba devices are strongly advised to promptly apply patches to mitigate the risks associated with these vulnerabilities.

Key Takeaways

• TLStorm 2.0 vulnerabilities in Aruba and Avaya switches can lead to remote access to enterprise networks and the theft of confidential information.
• The misuse of the NanoSSL library affects devices from different switch vendors, including Aruba and Avaya switches, making them vulnerable to remote code execution (RCE) flaws.
• Avaya ERS and Aruba switch series are among the affected devices.
• Exploiting RCE vulnerabilities can lead to network segmentation breaches, data exfiltration, and the successful escape from captive portals.

TLStorm 2.0 Overview

TLStorm 2.0 introduces a new set of vulnerabilities, including memory corruption and TLS reassembly heap overflow vulnerabilities, which can be exploited to gain remote access to enterprise networks in affected Aruba and Avaya switches. These vulnerabilities were identified by security analysts at Armis, who conducted an overview analysis to assess the impact of these vulnerabilities. The memory corruption vulnerabilities in the RADIUS client implementation of Aruba switches (CVE-2022-23676) and the NanoSSL misuse (CVE-2022-23677) on multiple interfaces in Aruba switches pose significant risks. Additionally, Avaya switches are affected by a TLS reassembly heap overflow vulnerability (CVE-2022-29860) and an HTTP header parsing stack overflow vulnerability (CVE-2022-29861). Exploiting these vulnerabilities can lead to the breach of network segmentation, allowing attackers to add devices to the switch and potentially exfiltrate sensitive data. It is crucial for organizations using these switches to patch them promptly to mitigate the risks associated with these vulnerabilities.

Affected Devices

The devices affected by the vulnerabilities include Avaya ERS3500, ERS3600, ERS4900, and ERS5900 Series switches, as well as Aruba 5400R, 3810, 2920, 2930F, 2930M, 2530, and 2540 Series switches. To provide a better understanding of the affected devices, a table is presented below:

To mitigate the vulnerabilities, it is crucial for organizations to implement the following strategies:

1. Apply firmware updates provided by the vendors to patch the vulnerabilities.
2. Regularly monitor and update the firmware of the affected devices.
3. Implement network segmentation to limit the impact of potential attacks.
4. Employ network intrusion detection and prevention systems to detect and block any malicious activities.

By following these mitigation strategies and promptly applying firmware updates, organizations can protect their enterprise networks from the remote access vulnerabilities introduced by TLStorm 2.0.

Detected Vulnerabilities

Armis detected multiple vulnerabilities in the affected devices, including memory corruption vulnerabilities, NanoSSL misuse, TLS reassembly heap overflow vulnerability, and HTTP header parsing stack overflow vulnerability. These vulnerabilities pose significant risks to enterprise networks and can be exploited by attackers to gain remote access. The exploitation impact of these vulnerabilities is severe, as they can lead to the breach of network segmentation, unauthorized addition of devices, and data exfiltration. To mitigate these risks, organizations are strongly advised to patch their Avaya and Aruba devices as soon as possible. Patching these vulnerabilities will ensure the protection of corporate network security and prevent the transmission of sensitive information from internal networks to the internet. Prioritizing the patching of these devices is highly recommended to prevent potential attacks and maintain the integrity of enterprise networks.

Exploitation of RCE

Exploiting the remote code execution (RCE) vulnerabilities detected in the affected devices can have severe consequences for network segmentation and data security within enterprise networks. Attackers who successfully exploit these vulnerabilities can break network segmentation and gain unauthorized access to corporate networks. This can lead to the addition of unauthorized devices to the network, allowing attackers to manipulate the switch’s behavior and potentially breach corporate network security. The consequences of such breaches can include data exfiltration, where sensitive information is transmitted from internal networks to the internet without authorization. Additionally, exploiting RCE vulnerabilities can also enable attackers to escape from the captive portal, further compromising network security. It is crucial for organizations using the affected devices to patch them promptly to mitigate the risk of data breaches and protect their networks from these vulnerabilities.

Zero-Day Flaws

Zero-day flaws have been identified in Avaya switches, posing significant security risks to organizations using these devices. These vulnerabilities can be exploited without user involvement, making them highly dangerous. To address these risks, it is crucial for organizations to prioritize timely patching of their Avaya switches. Failure to do so can have severe consequences for enterprise network security.

Discussion ideas:

1. The impact of these zero-day flaws on enterprise network security cannot be underestimated. Attackers can potentially gain remote access to networks, compromising sensitive data and breaching network segmentation. This can lead to data exfiltration and unauthorized access to internal networks.
2. Timely patching is of utmost importance when dealing with zero-day vulnerabilities. By patching their Avaya switches, organizations can protect themselves against potential attacks and minimize the risk of exploitation. It is essential for organizations to stay updated with the latest patches and security updates provided by Avaya to ensure the security of their networks.

Patching Recommendations

Patching Avaya switches in a timely manner is crucial for organizations to mitigate the identified vulnerabilities and ensure the security of their networks. The impact of TLStorm 2.0 on enterprise networks is significant, as it allows attackers to gain remote access to these networks and potentially steal confidential information. The vulnerabilities in Avaya switches, including the TLS reassembly heap overflow vulnerability and the HTTP header parsing stack overflow vulnerability, pose a serious threat to network security. Timely patching is of utmost importance in order to prevent exploitation of these vulnerabilities. By applying the necessary patches, organizations can effectively protect their networks from unauthorized access and potential data exfiltration. It is highly recommended that organizations prioritize patching for Avaya switches to maintain the integrity and security of their enterprise networks.

Follow Cyber Security News

Staying informed about the latest developments in cybersecurity through sources like Cyber Security News is crucial for organizations to stay proactive in protecting their networks. Cybersecurity news sources provide valuable information on emerging threats, vulnerabilities, and best practices for securing enterprise networks. By staying updated, organizations can gain insights into new attack techniques and vulnerabilities that could potentially impact their systems. This knowledge allows them to take proactive measures to mitigate risks and implement necessary security patches or updates. Additionally, staying informed about cybersecurity news helps organizations stay ahead of potential threats and enables them to make informed decisions regarding their security strategies. Therefore, regularly following reputable cybersecurity news sources like Cyber Security News is essential for organizations to enhance their cybersecurity posture and safeguard their networks.

Other Recent News

Over 60% of AWS environments are vulnerable to Zenbleed attacks, highlighting the need for organizations to prioritize the security of their cloud infrastructure. Zenbleed is a critical security vulnerability that affects the popular BIND DNS software, allowing attackers to remotely execute arbitrary code and gain control over the affected system. This vulnerability can lead to unauthorized access, data breaches, and potential disruption of services. It is crucial for organizations to promptly patch and update their systems to mitigate the risk posed by Zenbleed attacks.

In addition to Zenbleed attacks, organizations also face challenges in API security. With the increasing reliance on application programming interfaces (APIs) for communication between different software systems, securing APIs has become a critical concern. Organizations must ensure proper authentication and authorization mechanisms, implement strong encryption, and regularly test and monitor their APIs for vulnerabilities.

Another recent concern is the rise of cryptojacking attack patterns. Cryptojacking refers to the unauthorized use of a victim’s computer resources to mine cryptocurrency. Attackers exploit vulnerabilities in systems or inject malicious code into websites to secretly mine cryptocurrency without the user’s knowledge. Microsoft has provided a cryptojacking attack patterns checklist to help administrators and security professionals identify and mitigate these threats.

Overall, organizations need to stay vigilant and proactive in addressing the challenges in API security, patching vulnerabilities like Zenbleed, and protecting against cryptojacking attacks to safeguard their systems and data.

Frequently Asked Questions

What is TLStorm 2.0 and how does it differ from the previous TLStorm disclosure?

TLStorm 2.0 refers to a set of critical bugs that enable remote access to enterprise networks. It differs from the previous TLStorm disclosure by introducing new vulnerabilities, impacting devices from different vendors, and requiring immediate mitigation strategies to protect against potential breaches.

How are the Avaya and Aruba switches affected by TLStorm 2.0 vulnerabilities?

The Avaya switches are affected by vulnerabilities in TLStorm 2.0, including a TLS reassembly heap overflow vulnerability and an HTTP header parsing stack overflow vulnerability. Similarly, the Aruba switches have vulnerabilities such as memory corruption and NanoSSL misuse.

What are the specific vulnerabilities identified in the Avaya and Aruba switches?

The specific vulnerabilities identified in Avaya switches include a TLS reassembly heap overflow vulnerability (CVE-2022-29860) and an HTTP header parsing stack overflow vulnerability (CVE-2022-29861). Aruba switches have memory corruption vulnerabilities (CVE-2022-23676) and NanoSSL misuse (CVE-2022-23677).

What are the potential consequences of exploiting the Remote Code Execution (RCE) vulnerabilities?

The potential consequences of exploiting the remote code execution (RCE) vulnerabilities include financial loss and data breaches. Attackers can gain unauthorized access to enterprise networks, leading to the theft of confidential information and possible financial damages.

Are the security flaws found in Avaya switches zero-day vulnerabilities?

Yes, the security flaws found in Avaya switches can be classified as zero-day vulnerabilities. These vulnerabilities can be exploited without user involvement, making it critical for organizations to promptly patch their Avaya devices to ensure protection against these vulnerabilities.