Vulnerability Note VU#399355
Cisco IOS and CatOS fail to properly validate ARP packets thereby overwriting device's MAC address in ARP table
There is a denial-of-service vulnerability in specific versions of Cisco IOS or CatOS.
A denial-of-service vulnerability exists in specific versions of Cisco IOS or CatOS. This vulnerability can cause the device to crash or become unavailable if specially crafted arp packets are directed at the vulnerable host. Quoting from the Cisco Advisory:
"It is possible to send an Address Resolution Protocol (ARP) packet on a local broadcast interface (for example: ethernet, cable, tokenring, fddi) which could cause a router or switch running specific versions of Cisco IOS® Software Release or CatOS to stop sending and receiving ARP packets on the local router interface. This will in a short time cause the router and local hosts to be unable to send packets to each other. ARP packets received by the router for the router's own interface address but a different Media Access Control (MAC) address will overwrite the router's MAC address in the ARP table with the one from the received ARP packet."
Attackers that are on the local network segment can cause vulnerable Cisco routers or switches to crash causing network outages. It may also be possible for an attacker to masquerade as the disabled router and do anything the legitimate router could do with the traffic (including reading, sending, and receiving data).
Contact your vendor for patches.
The syntax for this command for switches running CatOS is as follows:
Systems Affected (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|Cisco||Affected||-||15 Nov 2001|
CVSS Metrics (Learn More)
The CERT/CC would like to thank Cisco Systems for providing a description of this vulnerability and a patch to address it.
This document was written by Ian A. Finlay.
- CVE IDs: Unknown
- Date Public: 15 Nov 2001
- Date First Published: 15 Nov 2001
- Date Last Updated: 27 Nov 2001
- Severity Metric: 25.31
- Document Revision: 39
If you have feedback, comments, or additional information about this vulnerability, please send us email.