Cisco Aironet ARP table memory exhaustion denial of service
| cisco-aironet-arp-dos (24086) |  Low Risk |
Description:
Cisco Aironet Wireless Access Points running Cisco IOS are vulnerable to a denial of service attack. If a remote attacker sends spoofed Address Resolution Protocol (ARP) messages to the management interface of an affected device, the attacker could consume all available memory resources causing a denial of service. The device must be rebooted in order to resume normal functionality.
*CVSS:
| Base Score: | 5 |
| Access Vector: | Remote |
| Access Complexity: | Low |
| Authentication: | Not Required |
| Confidentiality Impact: | None |
| Integrity Impact: | None |
| Availability Impact: | Complete |
| Temporal Score: | 3.7 |
| Exploitability: | Unproven |
| Remediation Level: | Official-Fix |
| Report Confidence: | Confirmed |
Consequences:
Denial of Service
Remedy:
Refer to Cisco Security Advisory cisco-sa-20060112-wireless for upgrade and workaround information. See References.
References:
- cisco-sa-20060112-wireless: Cisco Security Advisory: Access Point Memory Exhaustion from ARP Attacks.
- BID-16217: Cisco Aironet Wireless Access Point ARP Memory Exhaustion Denial Of Service Vulnerability
- CVE-2006-0354: Cisco IOS before 12.3-7-JA2 on Aironet Wireless Access Points (WAP) allows remote authenticated users to cause a denial of service (termination of packet passing or termination of client connections) by sending the management interface a large number of spoofed ARP packets, which creates a large ARP table that exhausts memory, aka Bug ID CSCsc16644.
- OSVDB ID: 22375: Cisco Aironet Access Point ARP Memory Exhaustion DoS
- SA18430: Cisco Access Point ARP Memory Exhaustion Denial of Service
- SECTRACK ID: 1015483: Cisco Aironet Wireless Access Point Memory Can Be Consumed With Spoofed ARP Packets
- VUPEN/ADV-2006-0176: Cisco Aironet Wireless Access Points Denial of Service Vulnerability
Platforms Affected:
- Cisco Aironet AP1100
- Cisco Aironet AP1130AG
- Cisco Aironet AP1200
- Cisco Aironet AP1230AG
- Cisco Aironet AP1240AG
- Cisco Aironet AP1300
- Cisco Aironet AP350
- Cisco Aironet Bridge AP1400
Reported:
Jan 12, 2006
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net
* According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall IBM be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.