Fergie's Tech Blog

Cisco Airespace Wireless LAN Controllers Allow Unencrypted Network Access

Via Cisco.

Summary

Cisco Access Points operating in Lightweight Access Point Protocol (LWAPP) mode may allow unauthenticated end hosts to send unencrypted traffic to a secure network by sending frames from the Media Access Control (MAC) address of an already authenticated end host.

Only the access points that are operating in LWAPP (i.e., controlled by a separate Wireless LAN Controller) mode are affected. Access points that are running in autonomous mode are not affected.

Cisco has made free software available to address this vulnerability for affected customers.

This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20051102-lwapp.shtml.

Vulnerable Products

Cisco 1200, 1131, and 1240 series access points controlled by Cisco 2000 and 4400 series Airespace Wireless LAN (WLAN) Controllers that are running software version 3.1.59.24 are affected by this vulnerability.

This issue is only applicable to deployments where there is a separate WLAN controller. Any system without a separate WLAN controller is not vulnerable.
Products Confirmed Not Vulnerable

• Access points other than Cisco 1200, 1131 and 1240 series are not affected.
• Access points that are deployed without a separate WLAN controller are not affected.
• Access points that are controlled by WLAN controllers other than Cisco 2000 and 4400 series are not affected.
• Access points that are controlled by WLAN controllers which are running a software version other than 3.1.59.24 are not affected.
• Access points that are running in autonomous mode are not affected.
• Access points that are running VxWorks are not affected.

No other Cisco products are currently known to be affected by these vulnerabilities.

posted by Fergie @ 11/02/2005 07:38:00 AM