Vulnerability Note VU#399355

Cisco IOS and CatOS fail to properly validate ARP packets thereby overwriting device's MAC address in ARP table

Original Release date: 15 Nov 2001 | Last revised: 27 Nov 2001

Overview

There is a denial-of-service vulnerability in specific versions of Cisco IOS or CatOS.

Description

A denial-of-service vulnerability exists in specific versions of Cisco IOS or CatOS. This vulnerability can cause the device to crash or become unavailable if specially crafted arp packets are directed at the vulnerable host. Quoting from the Cisco Advisory:

"It is possible to send an Address Resolution Protocol (ARP) packet on a local broadcast interface (for example: ethernet, cable, tokenring, fddi) which could cause a router or switch running specific versions of Cisco IOS® Software Release or CatOS to stop sending and receiving ARP packets on the local router interface.  This will in a short time cause the router and local hosts to be unable to send packets to each other. ARP packets  received by the router for the router's own interface address but a different Media Access Control (MAC) address will overwrite the router's MAC address in the ARP table with the one from the received ARP packet."

This vulnerability impacts switches, routers, and other devices running Cisco IOS.

Impact

Attackers that are on the local network segment can cause vulnerable Cisco routers or switches to crash causing network outages. It may also be possible for an attacker to masquerade as the disabled router and do anything the legitimate router could do with the traffic (including reading, sending, and receiving data).

Solution

Contact your vendor for patches.

Workaround
The following workaround is taken from the Cisco Security Advisory.

Enter the router interface MAC address into the arp table with a configuration entry. This is sometimes known as "hard coding" the ARP table entry. The syntax for this command for routers and switches running IOS is as follows:
arp <ip-address> <hardware-address> <type>

The syntax for this command for switches running CatOS is as follows:
set arp [dynamic|permanent|static] <ip_address> <hardware_address>

The caveat to this workaround is identified with defect CSCdv04366, which will clear all manually entered MAC addresses from the ARP table, when they are the same as the interface MAC address, when the command "clear arp" is issued on the router.  This workaround does not survive a reboot of the router, and must be rewritten to the configuration after any reload or reboot.

Systems Affected (Learn More)

VendorStatusDate NotifiedDate Updated
CiscoAffected-15 Nov 2001
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A

References

Credit

The CERT/CC would like to thank Cisco Systems for providing a description of this vulnerability and a patch to address it.

This document was written by Ian A. Finlay.

Other Information

  • CVE IDs: Unknown
  • Date Public: 15 Nov 2001
  • Date First Published: 15 Nov 2001
  • Date Last Updated: 27 Nov 2001
  • Severity Metric: 25.31
  • Document Revision: 39

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.