Network World — Cisco has just released a new security advisory that details what caused the address storms that recently afflicted Duke University's wireless net.
The advisory, posted on the company's website, says that Cisco's wireless LAN controllers have "multiple vulnerabilities in the handling of Address Resolution Protocol (ARP) packets." These vulnerabilities "could result in a denial of service (DoS) in certain environments." The vendor is offering free software to patch this problem, and notes that "there are workarounds to mitigate the effects of these vulnerabilities."
In keeping with Cisco's standard format, the advisory makes no reference to the events at Duke, which were first reported a week ago. At the time, intermittent floods or storms of ARP requests were taking 20 to 30 WLAN access points offline for 10 to 15 minutes. The events involved the newly released Apple iPhone.
But a Cisco spokesman confirmed that the advisory deals with the problem uncovered at Duke. "To date, we have not seen widespread issues relating to Apple iPhone across our customers' networks," the spokesman wrote in an e-mail response.
The baffling problem, occurring at least nine times at Duke over about a week, triggered a wave of reader speculation, rants and recommendations on Networkworld.com and other Internet tech sites.
The advisory finally makes it clear that the iPhone simply triggered the ARP storms that were made possible by the controller vulnerabilities. Any other wireless client device, moving from one subnet to another, apparently could have done the same thing.
According to the advisory, the vulnerabilities are found in versions 4.1, 4.0, and 3.2 and earlier of the company's Wireless LAN Controller software. Affected products include the 4100 and 4400 series of controllers, the earlier Cisco-Airespace 4000 series controller (introduced shortly after Cisco acquired Airespace), the Catalyst 6500 series Wireless Services Module (WiSM, a single-board version of the controller), and the Catalyst 3750 Integrated Wireless LAN Controller.
Many other products are immune to these vulnerabilities, according to Cisco, including the 2000 and 2100 series controllers, various standalone access points, and the 3800, 2800 and 1800 series of Integrated Services Routers.
The identified vulnerabilities relate to a unicast ARP request that in certain circumstances can be flooded on the LAN links between a group of WLAN controllers (Cisco calls this a "mobility group").
The advisory notes that IP Version 4 hosts use a method, specified in the IETF standard RFC 4436, to detect if they have reattached to a network to which they had previously been attached. If so, the host may not have to request a new DHCP address lease if the current lease is still active, according to the advisory. To determine this reattachment, the host sends a unicast ARP request to the default gateway that it had previously used.
