When "Proxy ARP" or "No Broadcast" features are enabled in a clustered WLC setup, a network adjacent attacker with access to the local WiFi network may cause a WLC device to disconnect from the cluster causing a denial of service condition for the wireless access points.

This issue can not be exploited remotely over the Internet as access to the local WiFi network is essential to trigger this condition.

Juniper SIRT is not aware of any malicious exploitation of this vulnerability.

No other Juniper Networks products or platforms are affected by this issue.

This issue has been assigned CVE-2014-6381.

The following software releases have been updated to resolve this specific issue:
MSS versions:

• 9.1.1 and later
• 9.0.3.5 and later
• 9.0.2.11 and later
• 8.0.4 and later

WLC software is available for download from http://www.juniper.net/support/downloads/

Customers who need Service Release or release not available on the downloads site can contact JTAC to obtain these.

Disabling "Proxy ARP" and "No Broadcast" option would completely mitigate the issue.

2014-12-10: Initial publication.

• KB16613: Overview of the Juniper Networks SIRT Monthly Security Bulletin Publication Process [juniper.net]
• KB16765: In which releases are vulnerabilities fixed? [juniper.net]
• KB16446: Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories [juniper.net]
• Report a Security Vulnerability - How to Contact the Juniper Networks Security Incident Response Team