ID

VAR-200308-0076

CVE

CVE-2003-0511

TITLE

Cisco AP1x00 HTTP GET Request Remote Denial Of Service Attack Vulnerability

DESCRIPTION

The web server for Cisco Aironet AP1x00 Series Wireless devices running certain versions of IOS 12.2 allow remote attackers to cause a denial of service (reload) via a malformed URL. The Cisco Aironet AP1X00 series is a wireless access point issued by Cisco that provides wireless access solutions based on the 802.11b WIFI standard.  The web interface of the Cisco Aironet AP1X00 does not properly handle HTTP GET requests. A remote attacker could use this vulnerability to conduct a denial of service attack on the device. This attack does not require any authentication. After the attack is successful, the device needs to be restarted or it cannot service normal communications.  All VxWorks software-based Cisco Aironet Access Point 1200s are not affected by this vulnerability. These software versions include 11.56, 12.01T1, 12.02T1, and 12.03T. Such a request will cause the device to reload. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: HTTP GET Vulnerability in AP1x00 Revision 1.0 For Public Release 2003 July 28 16:00 UTC (GMT) ---------------------------------------------------------------------- Contents Summary Affected Products Details Impact Software Versions and Fixes Obtaining Fixed Software Workarounds Exploitation and Public Announcements Status of This Notice: FINAL Distribution Revision History Cisco Security Procedures ---------------------------------------------------------------------- Summary A vulnerability has been reported by an external researcher in Cisco IOS(R) release for Cisco Aironet AP1x00 Series Wireless devices. This vulnerability can cause the AP1x00 to reload and is documented as Cisco bug ID CSCeb49869 (registered customers only) (also CAN-2003-0511). There are workarounds available to mitigate the effects of this vulnerability. This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20030728-ap1x00.shtml. The external report can be found at http://www.vigilante.com/inetsecurity/advisories/VIGILANTE-2003002.htm leavingcisco.com. Although it mentions two issues only one is addressed by this advisory. The other issue, Cisco bug ID CSCdz29724 (registered customers only) (also CAN-2003-512), is present in all IOS software and is duplicated by the AP1x00 specific Cisco bug ID CSCeb49842 (registered customers only) . More details about it can be found at http://www.cisco.com/warp/public/707/cisco-sn-20030724-ios-enum.shtml. In order to determine your software release you should log on the Access Point using any account available and execute the following command: access-point> show ver Cisco Internetwork Operating System Software IOS (tm) C1100 Software (C1100-K9W7-M), Version 12.2(8)JA, EARLY DEPLOYMENT RELEASE SOFTWARE (fc1) ^^^^^^^^^ TAC Support: http://www.cisco.com/tac Copyright (c) 1986-2003 by cisco Systems, Inc. The Cisco IOS software version is displayed in the second line of the output. In this example it is 12.2(8)JA. Impact Repeated exploitation of this vulnerability can lead to a prolonged Denial-of-Service (DoS) of the AP1x00. Obtaining Fixed Software Cisco is offering free software upgrades to address these vulnerabilities for all affected customers. Customers may only install and expect support for the feature sets they have purchased. By installing, downloading, accessing or otherwise using such software upgrades, customers agree to be bound by the terms of Cisco's software license terms found at http://www.cisco.com/public/sw-license-agreement.html, or as otherwise set forth at the Cisco Connection Online Software Center at http://www.cisco.com/public/sw-center/sw-usingswc.shtml. Customers with service contracts should contact their regular update channels to obtain the free software upgrade identified via this advisory. For most customers with service contracts, this means that upgrades should be obtained through the Software Center on Cisco's worldwide website at http://www.cisco.com/tacpage/sw-center/sw-wireless.shtml. To access the software download URL, you must be a registered user and you must be logged in. Customers whose Cisco products are provided or maintained through prior or existing agreement with third-party support organizations such as Cisco Partners, authorized resellers, or service providers should contact that support organization for assistance with the upgrade, which should be free of charge. Customers who purchase direct from Cisco but who do not hold a Cisco service contract and customers who purchase through third-party vendors but are unsuccessful at obtaining fixed software through their point of sale should get their upgrades by contacting the Cisco Technical Assistance Center (TAC). TAC contacts are as follows. * +1 800 553 2447 (toll free from within North America) * +1 408 526 7209 (toll call from anywhere in the world) * e-mail: tac@cisco.com Please have your product serial number available and give the URL of this notice as evidence of your entitlement to a free upgrade. Free upgrades for non-contract customers must be requested through the TAC. Workarounds There are two workarounds for this vulnerability. The example of using access-class is given here: ap(config)# ip http access-class 10 ap(config)# access-list 10 permit host 10.0.0.1 In this example, host 10.0.0.1 is the only one that is allowed to access the AP. All other hosts are prohibited. To disable HTTP and enable SSH use this example: ap(config)# no ip http server ap(config)# ip domain name <your-domain> ap(config)# crypto key generate rsa The name for the keys will be: ap.your-domain Choose the size of the key modulus in the range of 360 to 2048 for your General Purpose Keys. Choosing a key modulus greater than 512 may take a few minutes. How many bits in the modulus [512]: 1024 % Generating 1024 bit RSA keys ...[OK] ap(config)# line vty 0 4 ap(config-line)# transport input ssh Now you can connect to the Cisco Aironet AP using SSH client from your computer. In addition to the workarounds it is possible to mitigate the exposure by configuring ACLs on the device so that only legitimate hosts can use the http service. This can be done in the following way: access-list 111 permit tcp host 10.0.0.1 host 10.0.0.50 eq www In this example the host 10.0.0.1 is the only one that is allowed to access the device at 10.0.0.50. You will have to change host IP addresses and the ACL number to suit your configuration. This ACL will have to be applied to all interfaces and block all IP addresses assigned to the affected device. Exploitation and Public Announcements This vulnerability is reported by Reda Zitouni from Vigilante. Their report can be found at http://www.vigilante.com/inetsecurity/advisories/VIGILANTE-2003002.htm leavingcisco.com. Status of This Notice: FINAL This is a final advisory. Although Cisco cannot guarantee the accuracy of all statements in this advisory, all of the facts have been checked to the best of our ability. Cisco does not anticipate issuing updated versions of this advisory unless there is some material change in the facts. Should there be a significant change in the facts, Cisco will update this advisory. A stand-alone copy or paraphrase of the text of this security advisory that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors. Distribution This notice will be posted on Cisco's worldwide website at . In addition to worldwide web posting, a text version of this notice is clear-signed with the Cisco PSIRT PGP key and is posted to the following e-mail and Usenet news recipients. * cust-security-announce@cisco.com * bugtraq@securityfocus.com * full-disclosure@lists.netsys.com * first-teams@first.org (includes CERT/CC) * cisco@spot.colorado.edu * cisco-nsp@puck.nether.net * comp.dcom.sys.cisco * Various internal Cisco mailing lists Future updates of this advisory, if any, will be placed on Cisco's worldwide website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates. Revision History +------------------------------------------+ |Revision|2003-July-28 16:00 UTC |Initial | |1.0 |(GMT) |public | | | |release.| +------------------------------------------+ Cisco Security Procedures Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/warp/public/707/sec_incident_response.shtml. This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go/psirt. ---------------------------------------------------------------------- This notice is Copyright 2003 by Cisco Systems, Inc. This notice may be redistributed freely after the release date given at the top of the text, provided that redistributed copies are complete and unmodified, and include all date and version information. ---------------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Comment: PGP Signed by Sharad Ahlawat, Cisco Systems PSIRT iD4DBQE/JUmbezGozzK2tZARArXRAKCIRsac6s3i7oRAEf4/2khQBKdEcgCXTsum aQeEFDQLBhqS5wu0CarFkg== =ehoq -----END PGP SIGNATURE----- . Firmware version 12.2(4)JA and earlier. The Arionet Bridge is vulnerable to a denial of service.This can be exploited remotely by an attacker. No user login or password is necessary. This can be accomplished by submitting a specially crafted request to the web server. There is no need to authenticate to perform this attack, only access to the web server is required. The Aironet bridge reboots upon receiving the request and failing to handle correctly this one. Afterwards, no further access to the WLAN or its services is possible. Vendor status: ************** Cisco was contacted June 19, 2003 and answered the same day. 5 days later, they told us that they would release a patch soon. The patch was finally released July 3, 2003. Vulnerability Assessment: A test case to detect this vulnerability was added to SecureScan NX in the upgrade package of July 28, 2003. You can see the documentation of this test case 17655 on SecureScan NX web site at http://securescannx.vigilante.com/tc/17655 . Please note that this version fixes some other bugs as TC 15438 (refer to release note). If not needed - disable access to the web feature on the Aironet Bridge. 2. If needed - restrict access to the HTTP service for outside connections. CVE: Common Vulnerabilities and Exposures group ( reachable at http://cve.mitre.org/ ) was contacted and assigned CAN-2003-0511 to this vulnerability. Links: ***** Cisco Advisory: http://www.cisco.com/warp/public/707/cisco-sa-20030728-ap1x00.shtml Vigilante Advisory: http://www.vigilante.com/inetsecurity/advisories/VIGILANTE-2003001.htm Product Homepage: http://www.cisco.com/warp/public/cc/pd/witc/ps4570 CVE: CAN-2003-0511 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-CAN-2003-0511 Credit: ****** This vulnerability was discovered by Reda Zitouni, member of our Security Watch Team at VIGILANTe. We wish to thank Cisco PSIRT Team for their fast answer to fix this problem. Copyright VIGILANTe.com, Inc. 2003-07-28 Disclaimer: ********** The information within this document may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties with regard to this information. In no event shall the author be liable for any consequences whatsoever arising out of or in connection with the use or spread of this information. Any use of this information lays within the user's responsibility. Feedback: ******** Please send suggestions, updates, and comments to securitywatch@vigilante.com

IOT TAXONOMY

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

other

CONFIGURATIONS

EXPLOIT AVAILABILITY

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Reda Zitouni※ reda.zitouni@vigilante.com

SOURCES

LAST UPDATE DATE

2025-04-03T22:16:46.854000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE