Cisco Alerts

Cisco Field Notice: Wi-Fi Protected Setup PIN Brute Force Vulnerability

George — Fri, 13 Jan 2012 15:56:18 +0000

Note the WPS vulnerability is with home and soho devices and not with Cisco enterprise gear. Note the models below:

Cisco Response

On December 27th, 2011 US-CERT released VU#723755 available here: http://www.kb.cert.org/vuls/id/723755

The US-CERT Vulnerability Note describes a vulnerability that exists in the Wi-Fi Alliance Wi-Fi Protected Setup (WPS) protocol, also known as Wi-Fi Simple Config, when devices are operating in PIN External Registrar (PIN-ER) mode. Devices operating in PIN-ER mode allow a WPS capable client to supply only the correct WPS PIN to configure their client on a properly secured network. A weakness in the protocol affects all devices that operate in the PIN-ER mode, and may allow an unauthenticated, remote attacker to brute force the WPS configuration PIN in a short amount of time.

The vulnerability is due to a flaw that allows an attacker to determine when the first 4-digits of the eight-digit PIN are known. This effectively reduces the PIN space from 10⁷ or 10,000,000 possible values to 10⁴ + 10³ which is 11,000 possible values. The eighth digit of the PIN is utilized as a checksum of the first 7 digits and does not contribute to the available PIN space. Because the PIN space has been significantly reduced, an attacker could brute force the WPS pin in as little as a few hours.

While the affected devices listed below implement the WPS 1.0 standard which requires that a 60-second lockout be implemented after three unsuccessful attempts to authenticate to the device, this does not substantially mitigate this issue as it only increases the time to exploit the protocol weakness from a few hours to at most several days. It is our recommendation to disable the WPS feature to prevent exploitation of this vulnerability.

Vulnerable Products:

Product Name	Is the WPS feature enabled by default?	Can the WPS feature be permanently disabled?
Access Points
Cisco WAP4410N	Yes	Yes
Unified Communications
Cisco UC320W	Yes	No
Wireless Routers/VPN/Firewall Devices
Cisco RV110W	Yes	Yes
Cisco RV120W	No	Yes
Cisco SRP521W	Yes	Yes
Cisco SRP526W	Yes	Yes
Cisco SRP527W	Yes	Yes
Cisco SRP541W	Yes	Yes
Cisco SRP546W	Yes	Yes
Cisco SRP547W	Yes	Yes
Cisco WRP400	Yes	Yes

Note: The Cisco Valet product line is maintained by the Cisco Linksys Business Unit. Information concerning the Cisco Valet line as well as information on Linksys by Cisco products will be forthcoming.

Products Confirmed Not Vulnerable:

Product Name	Not Affected Reason
Access Points/Wireless Bridges
Cisco AP541N	Does not support WPS
Cisco WAP200	Does not support WPS
Cisco WAP200E	Does not support WPS
Cisco WAP2000	Does not support WPS
Cisco WET200	Does not support WPS
Unified Communications
Cisco UC500 Series	Does not support WPS
Wireless Cameras
Cisco WVC210	Does not support WPS
Cisco WVC2300	Does not support WPS
Wireless Routers/VPN/Firewall Devices
Cisco SA520W	WPS not enabled by default Does not support PIN-ER configuration Mode
Cisco RV220W	Does not support WPS
Cisco WRV210	Does not support WPS
Cisco WRVS4400N	Does not support WPS

Additional Information

Workarounds:

Disable the Wi-Fi Protected Setup feature on devices that allow the feature to be disabled, as listed in the Vulnerable Products table. Cisco Systems has verified that the products that support disabling the WPS feature do indeed disable it and are not vulnerable once the feature has been disabled from the management interface.

Fixed Software:

Product Name	Fixed Software
Cisco WAP4410	To Be Released
Cisco RV110W	To Be Released
Cisco RV120W	To Be Released
Cisco UC320W	To Be Released
Cisco SRP521W	To Be Released
Cisco SRP526W	To Be Released
Cisco SRP527W	To Be Released
Cisco SRP541W	To Be Released
Cisco SRP546W	To Be Released
Cisco SRP547W	To Be Released
Cisco WRP400	To Be Released

Exploitation and Public Announcements:

Exploit code and functional attack tools that exploit the weakness within the WPS protocol have been released.

This vulnerability was discovered by Stefan ViehbÃ¶ck and Craig Heffner.

Status of this Notice: Final

THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.

A stand-alone copy or Paraphrase of the text of this document that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors.

Revision History

Â Revision	Â Date	Â Notes
1.0	01-11-2012	Initial Public Release

792x phone may not reconnect when invalid 5 GHz beacon received : CSCtk58591

George — Tue, 13 Dec 2011 02:22:38 +0000

A more recent bug found on 1.4(1) 792x handset code. Something to take note if you're on this code and using voice on 802.11a

CSCtk58591 Bug Details

792x phone may not reconnect when invalid 5 GHz beacon received

Symptom:
792x phone may not reconnect when invalid 5 GHz beacon received.

Conditions:
792x phone going out of range then comes back in range when set to scan 5 GHz.

Workaround:
Power cycle the phone.
Use 802.11b/g only mode.

Status
Open

Severity
3 - moderate

Last Modified
In Last 3 Days

Product
Cisco Unified IP Phone 7900 Series

Technology
Wireless, Mobile

1st Found-In
1.4(1)

Interpreting This Bug

Bug Toolkit provides access to the latest raw bug data so you have the earliest possible knowledge of bugs that may affect your network, avoiding un-necessary downtime or inconvenience. Because you are viewing a live database, sometimes the information provided is not yet complete or adequately documented. To help you interpret this bug data, we suggest the following:

This bug has a Moderate severity 3 designation. Things fail under unusual circumstances, or minor features do not work at all, or things fail but there is a low-impact workaround.

This is the highest level for documentation bugs. (Bug Toolkit may not provide access to all documentation bugs.)

Severity levels are designated by the engineering teams working on the bug. Severity is not an indication of customer priority which is another value used by engineering teams to determine overall customer impact.

Bug documentation often assumes intermediate to advanced troubleshooting and diagnosis knowledge. Novice users are encouraged to seek fully documented support documents and/or utilize other support options available.

End-of-Sale and End-of-Life Announcement for the Cisco 2100 Series Wireless LAN Controllers

George — Sat, 05 Nov 2011 14:29:41 +0000

End-of-Sale and End-of-Life Announcement for the Cisco 2100 Series Wireless LAN Controllers
Url: http://www.cisco.com/en/US/prod/collateral/wireless/ps6302/ps8322/ps7206/ps7221/end_of_life_notice_c51-691053.html
Description: Cisco announces the end-of-sale and end-of-life dates for the Cisco 2100 Series Wireless LAN Controllers. The last day to order the affected product(s) is May 2, 2012. Customers with active service contracts will continue to receive support from the Cisco Technical Assistance Center (TAC) as shown in Table 1 of the EoL bulletin. Table 1 describes the end-of-life milestones, definitions, and dates for the affected product(s). Table 2 lists the product part numbers affected by this announcement. For customers with active and paid service and support contracts, support will be available until the termination date of the contract, even if this date exceeds the Last Date of Support shown in Table 1.
Date: 2011-11-04 16:30:00.0

End-of-Sale and End-of-Life Announcement for the Cisco Aironet 1520 Series

George — Fri, 21 Oct 2011 12:33:51 +0000

Title: End-of-Sale and End-of-Life Announcement for the Cisco Aironet 1520 Series
Url: http://www.cisco.com/en/US/prod/collateral/wireless/ps5679/ps8368/end_of_life_notice_c51-688859.html
Description: Cisco announces the end-of-sale and end-of-life dates for the Cisco Aironet 1520 Series. The last day to order the affected product(s) is March 30, 2012. Customers with active service contracts will continue to receive support from the Cisco Technical Assistance Center (TAC) as shown in Table 1 of the EoL bulletin. Table 1 describes the end-of-life milestones, definitions, and dates for the affected product(s). Table 2 lists the product part numbers affected by this announcement. For customers with active and paid service and support contracts, support will be available until the termination date of the contract, even if this date exceeds the Last Date of Support shown in Table 1.
Date: 2011-09-30 15:05:00.0

End-of-Sale and End-of-Life Announcement for the Cisco Aironet 1400 Series

George — Fri, 21 Oct 2011 12:32:57 +0000

Title: End-of-Sale and End-of-Life Announcement for the Cisco Aironet 1400 Series
Url: http://www.cisco.com/en/US/prod/collateral/wireless/ps5679/ps5279/end_of_life_notice_c51-689032.html
Description: Cisco announces the end-of-sale and end-of-life dates for the Cisco Aironet 1400 Series. The last day to order the affected product(s) is December 30, 2011. Customers with active service contracts will continue to receive support from the Cisco Technical Assistance Center (TAC) as shown in Table 1 of the EoL bulletin. Table 1 describes the end-of-life milestones, definitions, and dates for the affected product(s). Table 2 lists the product part numbers affected by this announcement. For customers with active and paid service and support contracts, support will be available until the termination date of the contract, even if this date exceeds the Last Date of Support shown in Table 1.
Date: 2011-10-20 12:53:00.0

Cisco Security Advisory: Cisco Wireless LAN Controllers Denial of Service Vulnerability

George — Wed, 27 Apr 2011 21:30:16 +0000

DONT PING YOUR CISCO WLCs! LOL

Document ID: 112916

Advisory ID: cisco-sa-20110427-wlc

http://www.cisco.com/warp/public/707/cisco-sa-20110427-wlc.shtml

Revision 1.0

For Public Release 2011 April 27 1600 UTC (GMT)

Summary
Affected Products
Details
Vulnerability Scoring Details
Impact
Software Versions and Fixes
Workarounds
Obtaining Fixed Software
Exploitation and Public Announcements
Status of this Notice: FINAL
Distribution
Revision History
Cisco Security Procedures

Summary

The Cisco Wireless LAN Controller (WLC) product family is affected by a denial of service (DoS) vulnerability where an unauthenticated attacker could cause a device reload by sending a series of ICMP packets.

Cisco has released free software updates that address this vulnerability.

There are no available workarounds to mitigate this vulnerability.

This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20110427-wlc.shtml.

[Expand all sections] [Collapse all sections]

Affected Products

Vulnerable Products

This vulnerability affects Cisco WLC software versions 6.0 and later. The following products are affected by the vulnerability described in this Security Advisory:

Cisco 2100 Series Wireless LAN Controllers
Cisco WLC526 Mobility Express Controller (AIR-WLC526-K9)
Cisco NME-AIR-WLC Modules for Integrated Services Routers (ISRs)
Cisco NM-AIR-WLC Modules for Integrated Services Routers (ISRs)

Note: The Cisco NM-AIR-WLC have reached End-of-Life and End-of-Software Maintenance. Please refer to the following document for more information:

http://www.cisco.com/en/US/prod/collateral/modules/ps2797/prod_end-of-life_notice0900aecd806aeb34.html

Cisco Wavelink (Avalanche) Bug:CSCtb45669 Code 1.3(3)

George — Fri, 22 Apr 2011 02:09:51 +0000

We are deploying thosands of Cisco 7925 handsets with Wavelink. After extensive testing I discovered that I could not get the phone to reboot after a profile push. I reached out to Wesley Terry (Cisco's Escalation Team) and BAM! He delivers for me ... Thanks Wesley !

792x is not reprovisioning after receiving Wavelink package

Symptom: 792x is not reprovisioning after receiving Wavelink package.
If updating profile 1 or switching from profile 2, there is no provisioning trigger occurring, but the network profile config is updated.

The phone stays connected with the previous network profile information even if not existing in the network profiles.

Condition: Pushing a package to the 792x via Wavelink.

Workaround: Power cycle the phone

This is resolved in code 1.3(4)

Cisco WLC WLAN Summary Display Bug: CSCth52309 - 7.0.98.0

George — Tue, 12 Apr 2011 00:08:40 +0000

I was working with a colleague when I noticed the WLAN Summary Display on the WLC showed NO clients, when we knew there was indeed clients. In fact when you hit the client page there was over 100 clients on the controller.

After looking at another controller the WLAN Summary Display showed 30,000+ clients, again we knew this wasn't accurate. After speaking with a Cisco SE we discovered there is a bug in 7.0.98.0, "WLAN summary display defect causing wrong count to be displayed, defect number CSCth52309"

This bug is fixed in 7.0.114.51 or greater.

As of this post this BUG was not in the bug tool kit. However it comes from a very reliable Cisco SE.

CISCO ACS 5.x RADIUS EAP-PEAP MS-CHAPv2 BUG WITH A “BIG BITE”: CSCth66302

George — Sat, 19 Mar 2011 20:39:21 +0000

If you are using Cisco ACS 5.1 or 5.2 and you use EAP-PEAP with MSCHAP v2 you should be aware of bug CSCth66302. It’s nasty and could impact your wireless network.

If you leverage EAP-PEAP MS-CHAPv2 in your environment and you are using Cisco ACS version 5.1 or 5.2 you need to be aware of this bug!

The bug we hit was CSCth66302 and it wasn’t pretty. As wireless clients attempted to authenticate the Cisco ACS responded with client failures, thus not authenticating the clients. When you looked at the ACS logs you would immediately see “Radius Authentication Request Rejected due to critical logging error” in nice big red letters! When you looked at the WLC the logs showed all the EAP-PEAP clients failing authentication.

Interestingly enough, the Cisco WLC NEVER moved to the back up ACS, which was configured under the WLAN. Why? Because the local ACS sever (which was failing) still responded to the client via the WLC. As far as the WLC was concerned, the ACS responded and life was good!

The Temporary Work Around from TAC

If you still get these messages the workaround is to restart ACS runtime service from the CLI:-

# acs stop runtime
# acs start runtime

Fix Coming in Release 5.3

Cisco TAC stated a fix will be released in ACS 5.3, which is yet to be released.

BUG Information

http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_system/5.2/release/notes/acs_52_rn.html

CSCth66302

RADIUS authentication request rejected because of a critical logging error.

Symptom: Running stress PEAP MS-CHAPV2 against primary ACS machine fails with the following error message:

Radius Authentication Request Rejected due to critical logging error

Conditions: This problem occurs when there is a large deployment setup with one primary connected to seven secondary machines.

Workaround: None.

End-of-Sale and End-of-Life Announcement for the Cisco 3350 Mobility Services Engine

George — Tue, 15 Mar 2011 23:31:55 +0000

Title: End-of-Sale and End-of-Life Announcement for the Cisco 3350 Mobility Services Engine

Url: http://www.cisco.com/en/US/prod/collateral/wireless/ps9733/ps9742/end_of_life_notice_c51-643839.html

Description: Cisco announces the end-of-sale and end-of-life dates for the Cisco® 3350 Mobility Services Engine. The last day to order the affected product(s) is June 5, 2011. Customers with active service contracts will continue to receive support from the Cisco Technical Assistance Center (TAC) as shown in Table 1 of the EoL bulletin. Table 1 describes the end-of-life milestones, definitions, and dates for the affected product(s). Table 2 lists the product part numbers affected by this announcement. For customers with active and paid service and support contracts, support will be available until the termination date of the contract, even if this date exceeds the Last Date of Support shown in Table 1.
Date: 2011-03-07 09:00:00.0