====================================================================

                                CERT-Renater

                       Note d'Information No. 2016/VULN177
_____________________________________________________________________

DATE                : 21/04/2016

HARDWARE PLATFORM(S): Cisco Wireless LAN Controller (WLC) devices.

OPERATING SYSTEM(S): Cisco AireOS Software.

======================================================================
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160420-wlc
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160420-bdos
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160420-htrd
____________________________________________________________________

Cisco Security Advisory: Cisco Wireless LAN Controller Management 
Interface Denial of Service Vulnerability

Advisory ID: cisco-sa-20160420-wlc

Revision 1.0

For Public Release 2016 April 20 16:00  GMT (UTC)

+---------------------------------------------------------------------

Summary
=======

A vulnerability in the web-based management interface of Cisco Wireless
LAN Controller (WLC) devices running Cisco AireOS Software could allow
an unauthenticated, remote attacker to cause an affected device to
reload, resulting in a denial of service (DoS) condition.

The vulnerability is due to the presence of unsupported URLs in the
web-based device management interface provided by the affected
software. An attacker could exploit this vulnerability by attempting to
access a URL that is not generally accessible from and supported by the
management interface. A successful exploit could allow the attacker to
cause the device to reload, resulting in a DoS condition.

Cisco has released software updates that address this vulnerability.
There are no workarounds that address this vulnerability.

This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160420-wlc

____________________________________________________________________

Cisco Security Advisory: Cisco Wireless LAN Controller Denial of
Service Vulnerability

Advisory ID: cisco-sa-20160420-bdos

Revision 1.0

For Public Release 2016 April 20 16:00  GMT (UTC)

+---------------------------------------------------------------------

Summary
=======

A vulnerability in the Bonjour task manager of Cisco Wireless LAN
Controller (WLC) Software could allow an unauthenticated, remote
attacker to cause a denial of service (DoS) condition on an affected
device.

The vulnerability is due to improper handling of Bonjour traffic by the
affected software. An attacker could exploit this vulnerability by
sending crafted Bonjour traffic to an affected device. A successful
exploit could allow the attacker to cause the device to reload,
resulting in a DoS condition.

Cisco has released software updates that address this vulnerability.
There are no workarounds that address this vulnerability.

This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160420-bdos

____________________________________________________________________

Cisco Security Advisory: Cisco Wireless LAN Controller HTTP Parsing
Denial of Service Vulnerability

Advisory ID: cisco-sa-20160420-htrd

Revision 1.0

For Public Release 2016 April 20 16:00  GMT (UTC)

+---------------------------------------------------------------------

Summary
=======

A vulnerability in the HTTP URL redirect feature of Cisco Wireless LAN
Controller (WLC) Software could allow an unauthenticated, remote
attacker to cause a buffer overflow condition on an affected device,
resulting in a denial of service (DoS) condition.

The vulnerability is due to improper handling of HTTP traffic by the
affected software. An attacker could exploit this vulnerability by
sending a crafted HTTP request to an affected device. A successful
exploit could allow the attacker to cause a buffer overflow condition
on the device, which could allow the attacker to cause the device to
reload, resulting in a DoS condition, or execute arbitrary code on the
device.

Cisco has released software updates that address this vulnerability.
There are no workarounds that address this vulnerability.

This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160420-htrd

==========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================