TITLE:
Cisco Access Point ARP Memory Exhaustion Denial of Service

SECUNIA ADVISORY ID:
SA18430

VERIFY ADVISORY:
http://secunia.com/advisories/18430/

CRITICAL:
Less critical

IMPACT:
DoS

WHERE:
>From local network

OPERATING SYSTEM:
Cisco Aironet 1300 Series Access Point
http://secunia.com/product/6794/
Cisco Aironet 1240 AG Series Access Point
http://secunia.com/product/6034/
Cisco Aironet 1230 AG Series Access Point
http://secunia.com/product/6795/
Cisco Aironet 1200 Series Access Point
http://secunia.com/product/1929/
Cisco Aironet 1130 AG Series Access Point
http://secunia.com/product/6037/
Cisco Aironet 1100 Series Access Point
http://secunia.com/product/1928/
Cisco Aironet 1400 Series Wireless Bridge
http://secunia.com/product/1930/
Cisco Aironet 350 Series Access Point
http://secunia.com/product/5114/

DESCRIPTION:
A vulnerability has been reported in Cisco Aironet Wireless AP
(Access Point), which can be exploited by malicious people to cause a
DoS (Denial of Service).

The vulnerability is caused due to an error in the handling of
spoofed ARP messages. This can be exploited by sending spoofed ARP
messages to the management interface of the AP to continuously add
entries to the ARP table of the device until the device runs out of
memory. 

Successful exploitation causes the AP to be unable to pass traffic
until the device is restarted, but requires the ability to send ARP
messages to the management interface of the AP.

The vulnerability has been reported in the following APs that run
Cisco IOS Software:
* Cisco Aironet 1400 Series Wireless Bridges
* Cisco Aironet 1300 Series Access Points
* Cisco Aironet 1240AG Series Access Points
* Cisco Aironet 1230AG Series Access Points
* Cisco Aironet 1200 Series Access Points
* Cisco Aironet 1130AG Series Access Points
* Cisco Aironet 1100 Series Access Points
* Cisco Aironet 350 Series Access Points running IOS

Note: Cisco Wireless devices running a VxWorks based image (Version
12.05 and earlier) are reportedly not vulnerable.

SOLUTION:
Update to IOS version 12.3-7-JA2.
http://tools.cisco.com/support/downloads/pub/MDFTree.x?butype=wireless

PROVIDED AND/OR DISCOVERED BY:
Reported by vendor.

ORIGINAL ADVISORY:
http://www.cisco.com/warp/public/707/cisco-sa-20060112-wireless.shtml

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------