CVE-2009-2861 - The Over-the-Air Provisioning (OTAP) functionality on Cisco Aironet Lightweight Access Point 1100 an

CVE-2009-2861

Summary

The Over-the-Air Provisioning (OTAP) functionality on Cisco Aironet Lightweight Access Point 1100 and 1200 devices does not properly implement access-point association, which allows remote attackers to spoof a controller and cause a denial of service (service outage) via crafted remote radio management (RRM) packets, aka "SkyJack" or Bug ID CSCtb56664.

References

Vulnerable Configurations

cpe:2.3:h:cisco:aironet_ap1100:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:aironet_ap1100:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:aironet_ap1200:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:aironet_ap1200:*:*:*:*:*:*:*:*

CVSS

Base:	7.3 (as of 28-08-2009 - 04:00)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
ADJACENT_NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
NONE	COMPLETE	COMPLETE

cvss-vector via4

AV:A/AC:M/Au:N/C:N/I:C/A:C

refmap via4

bid	36145
confirm	http://tools.cisco.com/security/center/viewAlert.x?alertId=18919
misc	http://www.airmagnet.com/assets/AM_Technote_SkyJack_082509.pdf http://www.airmagnet.com/news/press_releases/2009/08252009.php
sectrack	1022774
vupen	ADV-2009-2419

Last major update

28-08-2009 - 04:00

Published

27-08-2009 - 17:00

Last modified

28-08-2009 - 04:00