There is a denial-of-service vulnerability in specific versions of Cisco IOS or CatOS.
A denial-of-service vulnerability exists in specific versions of Cisco IOS or CatOS. This vulnerability can cause the device to crash or become unavailable if specially crafted arp packets are directed at the vulnerable host. Quoting from the Cisco Advisory:
"It is possible to send an Address Resolution Protocol (ARP) packet on a local broadcast interface (for example: ethernet, cable, tokenring, fddi) which could cause a router or switch running specific versions of Cisco IOS® Software Release or CatOS to stop sending and receiving ARP packets on the local router interface. This will in a short time cause the router and local hosts to be unable to send packets to each other. ARP packets received by the router for the router's own interface address but a different Media Access Control (MAC) address will overwrite the router's MAC address in the ARP table with the one from the received ARP packet."
This vulnerability impacts switches, routers, and other devices running Cisco IOS.
Attackers that are on the local network segment can cause vulnerable Cisco routers or switches to crash causing network outages. It may also be possible for an attacker to masquerade as the disabled router and do anything the legitimate router could do with the traffic (including reading, sending, and receiving data).
Contact your vendor for patches.
The following workaround is taken from the Cisco Security Advisory.
Enter the router interface MAC address into the arp table with a configuration entry. This is sometimes known as "hard coding" the ARP table entry. The syntax for this command for routers and switches running IOS is as follows:
arp <ip-address> <hardware-address> <type>
The syntax for this command for switches running CatOS is as follows:
set arp [dynamic|permanent|static] <ip_address> <hardware_address>
The caveat to this workaround is identified with defect CSCdv04366, which will clear all manually entered MAC addresses from the ARP table, when they are the same as the interface MAC address, when the command "clear arp" is issued on the router. This workaround does not survive a reboot of the router, and must be rewritten to the configuration after any reload or reboot.
Filter by status: All Affected Not Affected Unknown
Filter by content: __ Additional information available
__ Sort by: Status Alphabetical
Updated: November 15, 2001
Please see <http://www.cisco.com/warp/public/707/IOS-arp-overwrite-vuln-pub.shtml>
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Group | Score | Vector
Base | |
Temporal | |
Environmental | |
The CERT/CC would like to thank Cisco Systems for providing a description of this vulnerability and a patch to address it.
This document was written by Ian A. Finlay.
CVE IDs: | None
Severity Metric: | 25.31
Date Public: | 2001-11-15
Date First Published: | 2001-11-15
Date Last Updated: | 2001-11-27 20:30 UTC
Document Revision: | 39