Cisco has released a new security advisory that details what caused the address storms that recently afflicted Duke University's wireless network.
The advisory, posted on the company’s website, says that Cisco’s wireless LAN controllers have “multiple vulnerabilities in the handling of Address Resolution Protocol (ARP) packets.”
These vulnerabilities “could result in a denial of service (DoS) in certain environments.”
The vendor is offering free software to patch this problem, and notes that “there are workarounds to mitigate the effects of these vulnerabilities.”
In keeping with Cisco's standard format, the advisory makes no reference to the events at Duke, which were first reported a week ago. At the time, intermittent floods or storms of ARP requests were taking 20 to 30 WLAN access points offline for 10 to 15 minutes. The events involved the newly-released Apple iPhone.
But a Cisco spokesman confirmed that the advisory deals with the problem uncovered at Duke. “To date, we have not seen widespread issues relating to Apple iPhone across our customers' networks,” the spokesman wrote in an email response.
The baffling problem, occurring at least nine times at Duke over about a week, triggered a wave of reader speculation, rants, and recommendations on many tech websites.
The advisory finally makes it clear that the iPhone simply triggered the ARP storms that were made possible by the controller vulnerabilities. Any other wireless client device, moving from one subnet to another, apparently could have done the same thing.
According to the advisory, the vulnerabilities are found in versions 4.1, 4.0, and 3.2 and earlier of the company’s Wireless LAN Controller software. Affected products include the 4100 and 4400 series of controllers, the earlier Cisco-Airespace 4000 series controller (introduced shortly after Cisco acquired Airespace), the Catalyst 6500 series Wireless Services Module (WiSM, a single-board version of the controller), and the Catalyst 3750 Integrated Wireless LAN Controller.
Many other products are immune to these vulnerabilities, according to Cisco, including the 2000 and 2100 series controllers, various stand-alone access points, and the 3800, 2800, and 1800 series of Integrated Services Routers.
The identified vulnerabilities relate to a unicast ARP request which in certain circumstances can be flooded on the LAN links between a group of WLAN controllers.
Cisco will release software updates for versions 3.2 and 4.0 of the controller software on 27 July 27. An update for version 4.1 is apparently now available from Cisco. Cisco also recommends that administrators require all clients to obtain their IP address from a DHCP server.