A vulnerability in 802.11 Wireless Multimedia Extensions (WME) action frame processing in Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition. The vulnerability is due to incomplete input validation of the 802.11 WME packet header. An attacker could exploit this vulnerability by sending malformed 802.11 WME frames to a targeted device. A successful exploit could allow the attacker to cause the WLC to reload unexpectedly. The fixed versions are 8.0.140.0, 8.2.130.0, and 8.3.111.0. Cisco Bug IDs: CSCva86353.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Wireless_lan_controller | Cisco | 5.2.157.0 (including) | 5.2.157.0 (including) |
| Wireless_lan_controller | Cisco | 5.2.169.0 (including) | 5.2.169.0 (including) |
| Wireless_lan_controller | Cisco | 6.0_base (including) | 6.0_base (including) |
| Wireless_lan_controller | Cisco | 7.0_base (including) | 7.0_base (including) |
| Wireless_lan_controller | Cisco | 7.1_base (including) | 7.1_base (including) |
| Wireless_lan_controller | Cisco | 7.2_base (including) | 7.2_base (including) |
| Wireless_lan_controller | Cisco | 7.3.101.0 (including) | 7.3.101.0 (including) |
| Wireless_lan_controller | Cisco | 7.3.103.8 (including) | 7.3.103.8 (including) |
| Wireless_lan_controller | Cisco | 7.3.112 (including) | 7.3.112 (including) |
| Wireless_lan_controller | Cisco | 7.3_base (including) | 7.3_base (including) |
| Wireless_lan_controller | Cisco | 7.4.1.1 (including) | 7.4.1.1 (including) |
| Wireless_lan_controller | Cisco | 7.4.100 (including) | 7.4.100 (including) |
| Wireless_lan_controller | Cisco | 7.4.100.60 (including) | 7.4.100.60 (including) |
| Wireless_lan_controller | Cisco | 7.4.110.0 (including) | 7.4.110.0 (including) |
| Wireless_lan_controller | Cisco | 7.4.121.0 (including) | 7.4.121.0 (including) |
| Wireless_lan_controller | Cisco | 7.4_base (including) | 7.4_base (including) |
| Wireless_lan_controller | Cisco | 7.5.102.0 (including) | 7.5.102.0 (including) |
| Wireless_lan_controller | Cisco | 7.5.102.11 (including) | 7.5.102.11 (including) |
| Wireless_lan_controller | Cisco | 7.5_base (including) | 7.5_base (including) |
| Wireless_lan_controller | Cisco | 7.6.1.62 (including) | 7.6.1.62 (including) |
| Wireless_lan_controller | Cisco | 7.6.100.0 (including) | 7.6.100.0 (including) |
| Wireless_lan_controller | Cisco | 7.6.110.0 (including) | 7.6.110.0 (including) |
| Wireless_lan_controller | Cisco | 7.6.120.0 (including) | 7.6.120.0 (including) |
| Wireless_lan_controller | Cisco | 7.6.130.0 (including) | 7.6.130.0 (including) |
| Wireless_lan_controller | Cisco | 8.0.0 (including) | 8.0.0 (including) |
| Wireless_lan_controller | Cisco | 8.0.0.30220.385 (including) | 8.0.0.30220.385 (including) |
| Wireless_lan_controller | Cisco | 8.0.72.140 (including) | 8.0.72.140 (including) |
| Wireless_lan_controller | Cisco | 8.0.100 (including) | 8.0.100 (including) |
| Wireless_lan_controller | Cisco | 8.0.115.0 (including) | 8.0.115.0 (including) |
| Wireless_lan_controller | Cisco | 8.0.120.0 (including) | 8.0.120.0 (including) |
| Wireless_lan_controller | Cisco | 8.0.121.0 (including) | 8.0.121.0 (including) |
| Wireless_lan_controller | Cisco | 8.1.0 (including) | 8.1.0 (including) |
| Wireless_lan_controller | Cisco | 8.1.104.37 (including) | 8.1.104.37 (including) |
| Wireless_lan_controller | Cisco | 8.1.111.0 (including) | 8.1.111.0 (including) |
| Wireless_lan_controller | Cisco | 8.1.122.0 (including) | 8.1.122.0 (including) |
| Wireless_lan_controller | Cisco | 8.1.130.0 (including) | 8.1.130.0 (including) |
| Wireless_lan_controller_6.0 | Cisco | 182.0 (including) | 182.0 (including) |
| Wireless_lan_controller_6.0 | Cisco | 188.0 (including) | 188.0 (including) |
| Wireless_lan_controller_6.0 | Cisco | 196.0 (including) | 196.0 (including) |
| Wireless_lan_controller_6.0 | Cisco | 199.4 (including) | 199.4 (including) |
| Wireless_lan_controller_6.0 | Cisco | 202.0 (including) | 202.0 (including) |
| Wireless_lan_controller_7.0 | Cisco | 98.0 (including) | 98.0 (including) |
| Wireless_lan_controller_7.0 | Cisco | 98.218 (including) | 98.218 (including) |
| Wireless_lan_controller_7.0 | Cisco | 116.0 (including) | 116.0 (including) |
| Wireless_lan_controller_7.0 | Cisco | 220.0 (including) | 220.0 (including) |
| Wireless_lan_controller_7.0 | Cisco | 240.0 (including) | 240.0 (including) |
| Wireless_lan_controller_7.0 | Cisco | 250.0 (including) | 250.0 (including) |
| Wireless_lan_controller_7.0 | Cisco | 252.0 (including) | 252.0 (including) |
| Wireless_lan_controller_7.1 | Cisco | 91.0 (including) | 91.0 (including) |
| Wireless_lan_controller_7.2 | Cisco | 103.0 (including) | 103.0 (including) |
| Wireless_lan_controller_7.4 | Cisco | 1.19 (including) | 1.19 (including) |
| Wireless_lan_controller_7.4 | Cisco | 1.54 (including) | 1.54 (including) |
| Wireless_lan_controller_7.4 | Cisco | 140.0 (including) | 140.0 (including) |
References
- http://www.securityfocus.com/bid/97424
- http://www.securitytracker.com/id/1038182
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170405-wlc
- http://www.securityfocus.com/bid/97424
- http://www.securitytracker.com/id/1038182
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170405-wlc