Multiple Vulnerabilities in Cisco Wireless LAN Controllers

An article by Fabio Semperboni    No Comments

(No Ratings Yet)

Multiple vulnerabilities exist in the Cisco Wireless LAN Controller (WLC) platforms. This security advisory outlines the details of the following vulnerabilities:

• Malformed HTTP or HTTPS authentication response denial of service vulnerability
• SSH connections denial of service vulnerability
• Crafted HTTP or HTTPS request denial of service vulnerability
• Crafted HTTP or HTTPS request unauthorized configuration modification vulnerability

Vulnerable Products
Cisco 1500 Series, 2000 Series, 2100 Series, 4400 Series, 4100 Series, 4200 Series, Wireless Services Modules (WiSM), WLC Modules for Integrated Services Routers, and Cisco Catalyst 3750G Integrated Wireless LAN Controllers are affected by one or more of the following vulnerabilities:

• The malformed HTTP or HTTPS authentication response denial of service vulnerability affects software versions 4.2 and later.
• The SSH connections denial of service vulnerability affects software versions 4.1 and later.
• The crafted HTTP or HTTPS request denial of service vulnerability affects software versions 4.1 and later.
• The crafted HTTP or HTTPS request unauthorized configuration modification vulnerability affects software versions 4.1 and later.

Details
Cisco Wireless LAN Controllers (WLCs) are responsible for system-wide wireless LAN functions, such as security policies, intrusion prevention, RF management, quality of service (QoS), and mobility. These devices communicate with controller-based access points over any Layer 2 (Ethernet) or Layer 3 (IP) infrastructure using the Lightweight Access Point Protocol (LWAPP).

Impact
Successful exploitation of the denial of service (DoS) vulnerabilities may cause the affected device to reload. Repeated exploitation could result in a sustained DoS condition. An unauthenticated, remote attacker may be able to use the unauthorized configuration modification vulnerability to gain full control over the Wireless LAN Controller if the attacker is able to submit a crafted request directly to an administrative interface of the affected device.

Link: http://www.cisco.com/…/products_security_advisory.shtml