PT-2009-3723 · Cisco · Cisco Wireless Lan Controller+1

Published 2009-07-27 · Updated 2009-08-07 · CVE-2009-1164

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco Wireless LAN Controller (WLC) platform versions 4.2 before 4.2.205.0 Cisco Wireless LAN Controller (WLC) platform versions 5.x before 5.2.178.0

Description The administrative web interface on the Cisco Wireless LAN Controller (WLC) platform allows remote attackers to cause a denial of service (device reload) via a malformed response to an HTTP or HTTPS authentication request. Multiple vulnerabilities exist in the Cisco Wireless LAN Controller platforms, including denial of service vulnerabilities and unauthorized configuration modification vulnerabilities.

Recommendations For versions 4.2 before 4.2.205.0, update to version 4.2.205.0 or later to address the vulnerabilities. For versions 5.x before 5.2.178.0, update to version 5.2.178.0 or later to address the vulnerabilities. As a temporary workaround, consider restricting access to the administrative web interface to minimize the risk of exploitation.

Fix

DoS

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2009-1164

Affected Products

Cisco Wireless Lan Controller

Cisco Wls

References · 5

• http://cisco.com/en/US/products/products_security_advisory09186a0080adb3d7.shtml · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20090727-wlc · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1164 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2009-1164 · Security Note
• http://vupen.com/english/advisories/2009/2021 · Note