[VulnWatch] Cisco Aironet AP 1100 Malformed HTTP Request Crash Vulnerability

From: Réda Zitouni (Reda.Zitouni_at_vigilante.com)
Date: 07/28/03

  • Next message: Réda Zitouni: "[VulnWatch] Cisco Aironet AP1100 Valid Account Disclosure Vulnerability"
    Date: Mon, 28 Jul 2003 18:10:13 +0200
    To: <bugtraq@securityfocus.com>
    
    

    VIGILANTe Security Watch Advisory
     
    Name: Cisco Aironet AP 1100 Malformed HTTP Request Crash Vulnerability
    Systems Affected: Tested on a Cisco Aironet AP1100 Model 1120B Series
    Wireless device.
    Firmware version 12.2(4)JA and earlier.
    Severity: High Risk
    Vendor URL: http://www.vigilante.com
    Authors: Reda Zitouni (reda.zitouni@vigilante.com)
    Date: 28th July 2003
    Advisory Code: VIGILANTE-2003001
     
    Description
    ***********
    Cisco Aironet 1100 Series Access Point is a device manufactured by Cisco
    Systems offering a WLAN solution based on the 802.11b Wifi standard.
    The Arionet Bridge is vulnerable to a denial of service.This can be
    exploited remotely by an attacker. No user login or password is
    necessary.
     
    Details
    *******
     
    It is possible to cause Cisco Aironet Access Point to crash and reboot
    if the HTTP server feature is enabled. This can be accomplished by
    submitting a specially crafted request to the web server. There is no
    need to authenticate to perform this attack, only access to the web
    server is required. The Aironet bridge reboots upon receiving the
    request and failing to handle correctly this one. Afterwards, no further
    access to the WLAN or its services is possible.
     
    Vendor status:
    **************
    Cisco was contacted June 19, 2003 and answered the same day. 5 days
    later, they told us that they would release a patch soon. The patch was
    finally released July 3, 2003.
     
    Vulnerability Assessment:
    A test case to detect this vulnerability was added to SecureScan NX in
    the upgrade package of July 28, 2003. You can see the documentation of
    this test case 17655 on SecureScan NX web site at
    http://securescannx.vigilante.com/tc/17655 .
    Fix: A firmware upgrading the Aironet IOS version to c1100-k9w7 has
    been released by Cisco. Please note that this version fixes some other
    bugs as TC 15438 (refer to release note).
     
    Workaround:
    ***********
    1. If not needed - disable access to the web feature on the Aironet
    Bridge.
    2. If needed - restrict access to the HTTP service for outside
    connections.
    CVE: Common Vulnerabilities and Exposures group ( reachable at
    http://cve.mitre.org/ ) was contacted and assigned CAN-2003-0511 to this
    vulnerability.
     
    Links:
    *****
    Cisco Advisory:
    http://www.cisco.com/warp/public/707/cisco-sa-20030728-ap1x00.shtml
    Vigilante Advisory:
    http://www.vigilante.com/inetsecurity/advisories/VIGILANTE-2003001.htm
    Product Homepage: http://www.cisco.com/warp/public/cc/pd/witc/ps4570
    CVE: CAN-2003-0511
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-CAN-2003-0511
     

    Credit:
    ******
    This vulnerability was discovered by Reda Zitouni, member of our
    Security Watch Team at VIGILANTe.
    We wish to thank Cisco PSIRT Team for their fast answer to fix this
    problem.
     
    Copyright VIGILANTe.com, Inc. 2003-07-28
     
    Disclaimer:
    **********
    The information within this document may change without notice. Use of
    this information constitutes acceptance for use in an AS IS condition.
    There are NO warranties with regard to this information. In no event
    shall the author be liable for any consequences whatsoever arising out
    of or in connection with the use or spread of this information. Any use
    of this information lays within the user's responsibility.
     
    Feedback:
    ********
    Please send suggestions, updates, and comments to
    securitywatch@vigilante.com.
     
     


  • Next message: Réda Zitouni: "[VulnWatch] Cisco Aironet AP1100 Valid Account Disclosure Vulnerability"

    Relevant Pages