bugtraq - Cisco Aironet 1300 DoS condition

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Tue, 21 Mar 2006 10:08:09 -0000
From: "Alex" <netshark@...ajoy.com>
To: <bugtraq@...urityfocus.com>
Subject: Cisco Aironet 1300 DoS condition

Cisco Aironet 1300 DoS condition

Synopsis
========
Cisco Aironet 1300 running IOS 12.3(8)JA with default settings is vulnerable
to a DoS condition.

Background
=============
Cisco Aironet 1300 is the state-of-art enterprise p2p wireless repeater from
Cisco.
Supports a wide range of features, including but not limited to vlan
trunking, vlan to SSID mapping, WDS, multiple wireless networks, MAC and IP
filtering, QoS, SNMP, WPA, RADIUS etc..
Its commonly used to link remote hotspot branches/clouds.
===============

Tested on:
========================
Several Aironet 1200/1300 upgraded to IOS 12.3(8)JA. Aironet 1200 are NOT
affected.

Description
=======================
IOS 12.3(8)JA default settings turn on IGMP Snooping helper and WiFi
Multimedia (WMM) features even if QoS is turned off. 
This two combined features generate by default a huge amount of multicast
packets sent to all interfaces, wired or wireless through the default vlan.
In the release notes, Cisco warns customers about the possibity of degration
in the 1300's performance when using these features. Aparently this
possibility is underestimated. This condition happens even if the AP is
upgraded from an old version.

Impact
==========================
Wireless connection to the AP becames impossible. 
Wired connection is seriously affected speccialy in networks with multiple
1300, where the IGMP packets are sent to the whole network.
As the 1300 are used tipically in the p2p sections of the wireless network,
the instant breakup of the wireless p2p links is a very high possibility. 
Depending of the topology, some 1300s may be virtually unreacheble through
network.

Solution
============================
Enter the global configuration mode in the IOS console and issue the
following commands:

no ip igmp snooping
no ip igmp snooping vlan 1 (optional - just to make sure)
no dot11 igmp snooping-helper
int Dot11Radio0
no dot11 qos mode
exit
wr
________________________________

Alex Ferreira
Sysadmin