Cisco Aironet Wireless Access Point ARP Memory Exhaustion Denial Of Service Vulnerability

Bugtraq ID:	16217
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Jan 12 2006 12:00AM
Updated:	Feb 07 2006 08:55PM
Credit:	Eric Smith at Bucknell University reported this issue to the vendor.
Vulnerable:	Cisco Aironet 350 IOS Cisco Aironet 1400 Cisco Aironet 1300 Cisco Aironet 1240AG Cisco Aironet 1230AG Cisco Aironet 1200 Cisco Aironet 1130AG Cisco Aironet 1100
Not Vulnerable:	Cisco IOS 12.3 -7-JA2

Cisco Aironet Wireless Access Point ARP Memory Exhaustion Denial Of Service Vulnerability

Various Cisco Aironet wireless access point devices are prone to a denial-of-service vulnerability. This issue is due to memory exhaustion caused by improper handling of an excessive number of ARP requests.

This issue allows attackers who can successfully associate with a vulnerable access point to exhaust the memory of the affected device. As a result, the device fails to pass legitimate traffic until it has been rebooted.

Cisco Aironet Wireless Access Point ARP Memory Exhaustion Denial Of Service Vulnerability

An exploit is not required.

Pasv <[email protected]> has made the following proof of concept exploit available:

• /data/vulnerabilities/exploits/ciskill.c

Cisco Aironet Wireless Access Point ARP Memory Exhaustion Denial Of Service Vulnerability

Solution:
Cisco has released an advisory, along with an updated version of Cisco IOS to address this issue. Please see the referenced advisory for further information.

Cisco Aironet Wireless Access Point ARP Memory Exhaustion Denial Of Service Vulnerability

References:

• Cisco Security Advisory: Access Point Memory Exhaustion from ARP Attacks (Cisco)
  
• Cisco Wireless Product Page (Cisco)