Software Engineering Institute

A denial-of-service vulnerability exists in specific versions of Cisco IOS or CatOS. This vulnerability can cause the device to crash or become unavailable if specially crafted arp packets are directed at the vulnerable host. Quoting from the Cisco Advisory:

"It is possible to send an Address Resolution Protocol (ARP) packet on a local broadcast interface (for example: ethernet, cable, tokenring, fddi) which could cause a router or switch running specific versions of Cisco IOS^® Software Release or CatOS to stop sending and receiving ARP packets on the local router interface.  This will in a short time cause the router and local hosts to be unable to send packets to each other. ARP packets  received by the router for the router's own interface address but a different Media Access Control (MAC) address will overwrite the router's MAC address in the ARP table with the one from the received ARP packet."

This vulnerability impacts switches, routers, and other devices running Cisco IOS.

Attackers that are on the local network segment can cause vulnerable Cisco routers or switches to crash causing network outages. It may also be possible for an attacker to masquerade as the disabled router and do anything the legitimate router could do with the traffic (including reading, sending, and receiving data).

Contact your vendor for patches.

Workaround
The following workaround is taken from the Cisco Security Advisory.

Enter the router interface MAC address into the arp table with a configuration entry. This is sometimes known as "hard coding" the ARP table entry. The syntax for this command for routers and switches running IOS is as follows:
arp <ip-address> <hardware-address> <type>

The syntax for this command for switches running CatOS is as follows:
set arp [dynamic|permanent|static] <ip_address> <hardware_address>

The caveat to this workaround is identified with defect CSCdv04366, which will clear all manually entered MAC addresses from the ARP table, when they are the same as the interface MAC address, when the command "clear arp" is issued on the router.  This workaround does not survive a reboot of the router, and must be rewritten to the configuration after any reload or reboot.