Vulnerability CVE-2006-0354


Published: 2006-01-22   Modified: 2012-02-12

Description:
Cisco IOS before 12.3-7-JA2 on Aironet Wireless Access Points (WAP) allows remote authenticated users to cause a denial of service (termination of packet passing or termination of client connections) by sending the management interface a large number of spoofed ARP packets, which creates a large ARP table that exhausts memory, aka Bug ID CSCsc16644.

See advisories in our WLB2 database:
Topic
Author
Date
Med.
Access Point Memory Exhaustion from ARP Attacks
CISCO
13.01.2006

Vendor: Cisco
Product: Aironet ap1300 
Product: Aironet ap1100 
Product: Aironet ap350 
Product: Aironet ap1200 
Product: Aironet ap1240ag 
Product: Aironet ap1400 
Product: Aironet ap1130ag 
Product: Aironet ap1230ag 

CVSS2 => (AV:A/AC:L/Au:S/C:N/I:N/A:C)

CVSS Base Score
Impact Subscore
Exploitability Subscore
5.5/10
6.9/10
5.1/10
Exploit range
Attack complexity
Authentication
Adjacent network
Low
Single time
Confidentiality impact
Integrity impact
Availability impact
None
None
Complete

 References:
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:5680
http://securityreason.com/securityalert/339
http://securitytracker.com/id?1015483
http://www.cisco.com/warp/public/707/cisco-sa-20060112-wireless.shtml
http://www.securityfocus.com/bid/16217
http://www.vupen.com/english/advisories/2006/0176
https://exchange.xforce.ibmcloud.com/vulnerabilities/24086

Related CVE
CVE-2019-1970
A vulnerability in the Secure Sockets Layer (SSL)/Transport Layer Security (TLS) protocol inspection engine of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass the configured file policies on an ...
CVE-2019-1958
A vulnerability in the web-based management interface of Cisco HyperFlex Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to insufficient CS...
CVE-2019-1955
A vulnerability in the Sender Policy Framework (SPF) functionality of Cisco AsyncOS Software for Cisco Email Security Appliances (ESA) could allow an unauthenticated, remote attacker to bypass configured user filters on the device. The vulnerability ...
CVE-2019-1954
A vulnerability in the web-based management interface of Cisco Webex Meetings Server Software could allow an unauthenticated, remote attacker to redirect a user to an undesired web page. The vulnerability is due to improper input validation of the UR...
CVE-2019-1951
A vulnerability in the packet filtering features of Cisco SD-WAN Solution could allow an unauthenticated, remote attacker to bypass L3 and L4 traffic filters. The vulnerability is due to improper traffic filtering conditions on an affected device. An...
CVE-2019-1949
A vulnerability in the web-based management interface of Cisco Firepower Management Center could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affecte...
CVE-2019-1945
Multiple vulnerabilities in the smart tunnel functionality of Cisco Adaptive Security Appliance (ASA) could allow an authenticated, local attacker to elevate privileges to the root user or load a malicious library file while the tunnel is being estab...
CVE-2019-1944
Multiple vulnerabilities in the smart tunnel functionality of Cisco Adaptive Security Appliance (ASA) could allow an authenticated, local attacker to elevate privileges to the root user or load a malicious library file while the tunnel is being estab...

Copyright 2019, cxsecurity.com

 

Back to Top