Some vulnerabilities have been reported in Cisco Wireless LAN Controllers, which can be exploited by malicious people to cause a DoS (Denial of Service) or compromise a vulnerable system.

1) An error in the processing of HTTP Basic authentication requests can be exploited to cause the device to reload by sending a specially crafted request containing overly long authentication data to the administrative web interface.

2) A memory leak in the handling of SSH management connections can be exploited to cause a crash and reload an affected device.

Successful exploitation does not require a three-way handshake.

3) An unspecified error in the processing of requests sent to the administrative web interface can be exploited to cause a crash and reload an affected device.

4) An error in the processing of HTTP and HTTPS requests can be exploited to modify the configuration of an affected device via specially crafted requests sent to an IP address that is bound to an administrative interface or VLAN.

Successful exploitation of this vulnerability allows to gain full control of the device.

Solution
Update to the latest versions (see vendor advisories for details).

Provided and/or discovered by
1) Christoph Bott
3) The vendor credits IBM Research.

Original Advisory
Cisco:
http://www.cisco.com/warp/public/707/cisco-sa-20090727-wlc.shtml

Christoph Bott:
http://archives.neohapsis.com/archives/fulldisclosure/2009-07/0407.html

Deep Links
Links available in Customer Area