[ad]
If your organisation is using any kind of Cisco Wi-Fi kit it may be time to get the latest patches for your kit. Although they state there is no proof that hackers have used this attack in the wild – in my experience if Cisco have discovered this now, someone else probably knew about it earlier.
There are multiple vulnerabilities mostly concerning malformed packets sent to the web authentication interface which can cause a reload or hanging of the hardware device.
Cisco is urging admins to update their wireless LAN hardware following the discovery of multiple vulnerabilities in its enterprise Wi-Fi kit.
Security flaws in Cisco Wireless LAN Controllers, Cisco Catalyst 6500 Wireless Services Modules (WiSMs), and Cisco Catalyst 3750 Integrated Wireless LAN Controllers create a mechanism for hackers to knock over vulnerable hardware.
All Cisco Wireless LAN Controllers running version 4.2 of the network giant’s software are affected by a pair of denial of service flaws. A third DoS flaw affects software versions 4.1 and later.
The denial of service bugs include a flaw in the handling of Web authentication, which can cause an affected device to reload, and a separate flaw (that also affects version 4.1 of the software) that means vulnerable kit can freeze up on receipt of malformed data packets.
Even if you have recent software (version 4.1) it’s also vulnerable to a separate flaw, which also needs to be patched. I’d imagine now the news is out, even if no one had discovered this previously a little bit of reverse engineering with yield some proof or concept or even a working exploit for these flaws.
You need to check your model numbers though as not all wireless devices are affected.
The same set of potential problems affects Cisco Catalyst 6500 Series/7600 Series Wireless Services Module and Cisco Catalyst 3750 Series Integrated Wireless LAN Controllers but not the equivalent wireless modules on Cisco 2800 and 3800 series Integrated Services Routers. Cisco 2000 and 2100 Series Wireless LAN Controllers are also unaffected by the vulnerability.
The denial of service problem is not the only issue to consider. Version 4.2.173.0 of Cisco’s Wireless LAN controller software is affected by a privilege escalation vulnerability. The security bug creates a means for an ordinary user to gain full administrative rights.
“Successful exploitation of the denial of service vulnerabilities may cause the affected device to hang or reload,” a security advisory from Cisco explains. “Repeated exploitation could result in a sustained DoS condition. The privilege escalation vulnerability may allow an authenticated user to obtain full administrative rights on the affected system.”
One of the flaws is a little more serious resulting in privilege escalation, the end result being administrative access. It does say though you need to be an authenticated user to achieve this – but as they say the majority of attacks come from within an organisation anyway.
As always be wary, and keep your patches up to date. A lot of organisations I’ve audited are very good on patching software, their antivirus is updated daily, Windows updates are applied regularly but often I’ve found hardware and especially Cisco devices woefully out of date.
The problem was discussed here a while ago with the Cisco Vulnerability Given ‘Write Once, Run Anywhere’ Treatement. Cisco needs to make it easier and more efficient for people to update their devices.
Source: The Register
cbrp1r8 says
“my experience if Cisco have discovered this now, someone else probably knew about it earlier.”
You can take that to the bank! :D