Cisco IOS and CatOS fail to properly validate ARP packets thereby overwriting device's MAC address in ARP table

Overview

There is a denial-of-service vulnerability in specific versions of Cisco IOS or CatOS.

Description

A denial-of-service vulnerability exists in specific versions of Cisco IOS or CatOS. This vulnerability can cause the device to crash or become unavailable if specially crafted arp packets are directed at the vulnerable host. Quoting from the Cisco Advisory:

“It is possible to send an Address Resolution Protocol (ARP) packet on a local broadcast interface (for example: ethernet, cable, tokenring, fddi) which could cause a router or switch running specific versions of Cisco IOS® Software Release or CatOS to stop sending and receiving ARP packets on the local router interface. This will in a short time cause the router and local hosts to be unable to send packets to each other. ARP packets received by the router for the router’s own interface address but a different Media Access Control (MAC) address will overwrite the router’s MAC address in the ARP table with the one from the received ARP packet.”

This vulnerability impacts switches, routers, and other devices running Cisco IOS.

---

Impact

Attackers that are on the local network segment can cause vulnerable Cisco routers or switches to crash causing network outages. It may also be possible for an attacker to masquerade as the disabled router and do anything the legitimate router could do with the traffic (including reading, sending, and receiving data).

---

Solution

Contact your vendor for patches.

---

Workaround
The following workaround is taken from the Cisco Security Advisory.

Enter the router interface MAC address into the arp table with a configuration entry. This is sometimes known as “hard coding” the ARP table entry. The syntax for this command for routers and switches running IOS is as follows:
arp <ip-address> <hardware-address> <type>

The syntax for this command for switches running CatOS is as follows:
set arp [dynamic|permanent|static] <ip_address> <hardware_address>

The caveat to this workaround is identified with defect CSCdv04366, which will clear all manually entered MAC addresses from the ARP table, when they are the same as the interface MAC address, when the command “clear arp” is issued on the router. This workaround does not survive a reboot of the router, and must be rewritten to the configuration after any reload or reboot.

---

Vendor Information

399355

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Cisco __ Affected

Updated: November 15, 2001

Status

Affected

Vendor Statement

Please see <http://www.cisco.com/warp/public/707/IOS-arp-overwrite-vuln-pub.shtml&gt;

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23399355 Feedback>).

CVSS Metrics

Group	Score	Vector
Base
Temporal
Environmental

References

• <http://www.cisco.com/warp/public/707/IOS-arp-overwrite-vuln-pub.shtml&gt;
• <http://www.securityfocus.com/bid/3547&gt;

Acknowledgements

The CERT/CC would like to thank Cisco Systems for providing a description of this vulnerability and a patch to address it.

This document was written by Ian A. Finlay.

Other Information

CVE IDs:	None
Severity Metric:	25.31 Date Public: