PT-2009-3725 · Cisco · Cisco Wireless Lan Controller+1

Published 2009-07-27 · Updated 2009-08-07 · CVE-2009-1166

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco Wireless LAN Controller (WLC) platform versions 4.x through 4.2.204.0 Cisco Wireless LAN Controller (WLC) platform versions 5.x through 5.2.190.0

Description The administrative web interface on the Cisco Wireless LAN Controller (WLC) platform allows remote attackers to cause a denial of service (device reload) via a crafted HTTP or HTTPS request. Multiple vulnerabilities exist in the Cisco Wireless LAN Controller platforms, including a malformed HTTP or HTTPS authentication response denial of service vulnerability, an SSH connections denial of service vulnerability, a crafted HTTP or HTTPS request denial of service vulnerability, and a crafted HTTP or HTTPS request unauthorized configuration modification vulnerability.

Recommendations For versions 4.x through 4.2.204.0, update to version 4.2.205.0 or later. For versions 5.x through 5.2.190.0, update to version 5.2.191.0 or later. As a temporary workaround, consider restricting access to the administrative web interface until a patch is available. Avoid using crafted HTTP or HTTPS requests in the affected API endpoints until the issue is resolved.

Fix

Related Identifiers

CVE-2009-1166

Affected Products

Cisco Wireless Lan Controller

Cisco Wls

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2009-1166 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1166 · Security Note
• http://cisco.com/en/US/products/products_security_advisory09186a0080adb3d7.shtml · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20090727-wlc · Vendor Advisory
• http://securitytracker.com/id?1022605 · Note
• http://vupen.com/english/advisories/2009/2021 · Note