Cisco Cisco Aironet 1200 Access Point Notas de publicación

CSCed78149—A document that describes how the Internet Control Message Protocol (ICMP) could 
be used to perform a number of Denial of Service (DoS) attacks against the Transmission Control 
Protocol (TCP) has been made publicly available. This document has been published through the 
Internet Engineering Task Force (IETF) Internet Draft process, and is entitled “ICMP Attacks 
Against TCP” (draft-gont-tcpm-icmp-attacks-03.txt).

These attacks, which only affect sessions terminating or originating on a device itself, can be of 
three types:

1. Attacks that use ICMP “hard” error messages 
2. Attacks that use ICMP “fragmentation needed and Don’t Fragment (DF) bit set” messages, also 
known as Path Maximum Transmission Unit Discovery (PMTUD) attacks 
3. Attacks that use ICMP “source quench” messages

Successful attacks may cause connection resets or reduction of throughput in existing connections, 
depending on the attack type.

Multiple Cisco products are affected by the attacks described in this Internet draft.

Cisco has made free software available to address these vulnerabilities. In some cases there are 
workarounds available to mitigate the effects of the vulnerability.

This advisory is posted at 

.

The disclosure of these vulnerabilities is being coordinated by the National Infrastructure Security 
Coordination Centre (NISCC), based in the United Kingdom. NISCC is working with multiple 
vendors whose products are potentially affected. Its posting can be found at: 
http://www.niscc.gov.uk/niscc/docs/re-20050412-00303.pdf?lang=en. 

CSCee39809—Access points configured for LEAP no longer randomly reboot.

CSCee49659, CSCef24770, CSCef50960, CSCef52120—Uninitialized fields in the message 
structure sent to the AAA authenticator no longer cause the access point to reboot.

CSCef06846—The access point no longer has a memory leak.

CSCef46191—A specifically crafted TCP connection to a telnet or reverse telnet port of an access 
point running Cisco IOS software no longer blocks further telnet, reverse telnet, Remote Shell 
(RSH), Secure Shell (SSH), and HTTP access to the access point.

CSCef66214—Uninitialized message structures no longer cause the access point to reboot.

For the most up-to-date, detailed troubleshooting information, refer to the Cisco TAC website at 

. Click Technology Support, choose Wireless 

from the menu on the left, and click Wireless LAN.