====================================================================

                              CERT-Renater

                 Note d'Information No. 2017/VULN322
_____________________________________________________________________

DATE                : 02/11/2017

HARDWARE PLATFORM(S): Cisco Aironet Series Access Point Platforms
                               versions 1560, 2800, 3800.
OPERATING SYSTEM(S):  Cisco Aironet Series Access Point Software.

=====================================================================
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171101-aironet1
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171101-aironet2
____________________________________________________________________

Cisco Security Advisory: Cisco Aironet 1560, 2800, and 3800 Series
Access Point Platforms 802.11 Denial of Service Vulnerability

Advisory ID: cisco-sa-20171101-aironet1

Revision: 1.0

For Public Release: 2017 November 1 16:00 GMT

Last Updated: 2017 November 1 16:00 GMT

CVE ID(s): CVE-2017-12273

CVSS Score v(3): 7.4 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

+---------------------------------------------------------------------

Summary
=======
A vulnerability in 802.11 association request frame processing for the
Cisco Aironet 1560, 2800, and 3800 Series Access Points could allow an
unauthenticated, Layer 2 radio frequency (RF) adjacent attacker to
cause the Access Point (AP) to reload, resulting in a denial of service
(DoS) condition.

The vulnerability is due to insufficient frame validation of the 802.11
association request. An attacker could exploit this vulnerability by
sending a malformed 802.11 association request to the targeted device.
An exploit could allow the attacker to cause the AP to reload,
resulting in a DoS condition while the AP is reloading.

Cisco has released software updates that address this vulnerability.
There are no workarounds that address this vulnerability.

This advisory is available at the following link:
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171101-aironet1
["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171101-aironet1"]

____________________________________________________________________

Cisco Security Advisory: Cisco Aironet 1560, 2800, and 3800 Series
Access Point Platforms Extensible Authentication Protocol Denial of
Service Vulnerability

Advisory ID: cisco-sa-20171101-aironet2

Revision: 1.0

For Public Release: 2017 November 1 16:00 GMT

Last Updated: 2017 November 1 16:00 GMT

CVE ID(s): CVE-2017-12274

CVSS Score v(3): 7.4 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

+---------------------------------------------------------------------

Summary
=======
A vulnerability in Extensible Authentication Protocol (EAP) ingress
frame processing for the Cisco Aironet 1560, 2800, and 3800 Series
Access Points could allow an unauthenticated, Layer 2 radio frequency
(RF) adjacent attacker to cause the Access Point (AP) to reload,
resulting in a denial of service (DoS) condition.

The vulnerability is due to insufficient  validation of the EAP frame.
An attacker could exploit this vulnerability by sending a malformed EAP
frame to the targeted device. A successful exploit could allow the
attacker to cause the AP to reload, resulting in a DoS condition while
the AP is reloading. It may be necessary to manually power cycle the
device in order for it to recover.

Cisco has released software updates that address this vulnerability.
There are no workarounds that address this vulnerability.

This advisory is available at the following link:
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171101-aironet2
["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171101-aironet2"]

==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================