topic Re: CVE-2023-35803 mitigation ? in ExtremeWireless (IQE)

CVE-2023-35803 mitigation ?

fran1942 — Wed, 19 Jul 2023 07:43:50 GMT

Hello, until we get the firmware upgraded, what sort of AP firewall policy is required to mitigate this vulnerability ? i.e inbound/outbound ? blocking port 5916 ?

CVE-2023-35803

Thank you kindly

Re: CVE-2023-35803 mitigation ?

w1f1n00b — Wed, 19 Jul 2023 13:01:34 GMT

For anyone who missed it here is the CVE announcement - https://community.extremenetworks.com/t5/security-advisories-formerly/sa-2023-067-iq-engine-acsd-service-buffer-overflow-cve-2023/ba-p/96472

I too would like to know a few more details about this CVE.

The other CVE posted Monday specifies what access is needed to conduct the exploit. I'm not seeing that information for this one which seems like very relevant information given that there are so many AP models that won't be seeing a patch for this for at least 3 months or more!

Re: CVE-2023-35803 mitigation ?

LaurentA — Thu, 20 Jul 2023 12:08:25 GMT

Hi,

According to the researcher Blog and Exploit code, the attacker needs to connect to the AP over the port TCP/5916.
A quick workaround should be to block this port to anyone (using Firewall in User-Profiles for Wi-Fi users, and using classic LAN segmentation for the wired users).
Regards,

Re: CVE-2023-35803 mitigation ?

fran1942 — Sun, 23 Jul 2023 22:11:27 GMT

thank you. Would that be an inbound or outbound policy to block TCP 5916 ?

Re: CVE-2023-35803 mitigation ?

LaurentA — Mon, 24 Jul 2023 14:02:28 GMT

Hi,
In all your Wireless User-Profiles in Firewall "Outbound Policy" you should block connection to TCP/5916 port by creating a "Deny" rule on top.
This will prevent attack from Wireless Users (for the Wired one, rely on your corporate firewall, as long as the AP are in an isolated network).
To ensure the port is not reachable anymore, you can use Microsoft Powershell "Test-NetConnection" commandlet.
Example, if your Access Point IP address is 10.0.0.10, you can use the following powershell command :
tnc 10.0.0.10 -port 5916
The "TcpTestSucceeded" result should be "false".

Regards,

Re: CVE-2023-35803 mitigation ?

fran1942 — Mon, 24 Jul 2023 20:25:51 GMT

thank you. So an 'outbound' policy controls traffic coming into the AP from wireless users ?

Re: CVE-2023-35803 mitigation ?

LaurentA — Tue, 25 Jul 2023 13:50:39 GMT

Hi, "Outbound" policy controls traffic sent by the Wireless Users (whatever is the destination).
Regards,