TITLE:
Cisco Wireless LAN Controllers Encryption Bypass Vulnerability

SECUNIA ADVISORY ID:
SA17406

VERIFY ADVISORY:
http://secunia.com/advisories/17406/

CRITICAL:
Less critical

IMPACT:
Security Bypass

WHERE:
>From local network

OPERATING SYSTEM:
Cisco Aironet 1240 AG Series Access Point
http://secunia.com/product/6034/
Cisco Aironet 1200 Series Access Point
http://secunia.com/product/1929/
Cisco Aironet 1130 AG Series Access Point
http://secunia.com/product/6037/
Cisco 4400 Series Wireless LAN Controller
http://secunia.com/product/6036/
Cisco 2000 Series Wireless LAN Controller
http://secunia.com/product/6035/

DESCRIPTION:
A vulnerability has been reported in Cisco WLAN (Wireless LAN)
Controllers, which can be exploited by malicious people to bypass
certain security restrictions.

The vulnerability is caused due to the WLAN controller accepting
unencrypted traffic from end hosts even when it is configured to
perform encryption. This can be exploited to send malicious traffic
to a secure wireless network by spoofing the MAC address of a
legitimate, already authenticated end host.

Successful exploitation requires that the access points are operating
in LWAPP (Lightweight Access Point Protocol) mode, and controlled by a
separate WLAN Controller.

The vulnerability has been reported in Cisco 1200, 1131, and 1240
series access points controlled by Cisco 2000 and 4400 series
Airespace WLAN Controllers with software version 3.1.59.24.

SOLUTION:
Update to version 3.1.105.0 of the WLAN Controller software.

Cisco 2000 Series WLAN Controller:
http://www.cisco.com/pcgi-bin/tablebuild.pl/2000_series_Wireless_LAN_controller

Cisco 4400 Series WLAN Controller:
http://www.cisco.com/pcgi-bin/tablebuild.pl/4400_series_Wireless_LAN_controller

ORIGINAL ADVISORY:
http://www.cisco.com/warp/public/707/cisco-sa-20051102-lwapp.shtml

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------