Vulnerability Note VU#472363

IPv6 implementations insecurely update Forwarding Information Base

Original Release date: 02 Oct 2008 | Last revised: 27 Apr 2009

Overview

A vulnerability in some implementations of the IPv6 Neighbor Discovery Protocol may allow a nearby attacker to intercept traffic or cause congested links to become overloaded.

Description

IPv6 networks use the Neighbor Discovery Protocol (NDP) to detect and locate routers and other on-link IPv6 nodes. NDP uses ICMPv6 types 133, 134, 135, and 136. Neighbor solicitation (type 135) messages are used by NDP to discover and determine the reachability of nearby IPv6 nodes. Nodes that can send each other NDP messages are considered to be on-link (as per RFC 4861).

After receiving a neighbor solicitation request from a system that is on-link and is using a spoofed IPv6 address as the source address, a router will create a neighbor cache entry. When this entry is made, some IPv6 implementations will create a Forwarding Information Base (FIB) entry. This FIB entry may cause the router to incorrectly forward traffic to the device that sent original spoofed neighbor solicitation request.

Note that an attacker must have IPv6 connectivity to the same router as their target for this vulnerability to be exploited. Although this vulnerability has only a local attack vector (NDP messages are not forwarded by routers), flat IPv6 networks can include many hosts and may cover large geographical distances as compared to IPv4 networks.

Similar problems to this issue have been discussed in RFC 3756 "IPv6 Neighbor Discovery (ND) Trust Models and Threats."

Impact

An attacker may be able to intercept private network traffic. Receiving the traffic may cause links to become congested or saturated due to the additional bandwidth. Administrators are encouraged to read RFC 3756 for more information about other possible vulnerabilities and impacts.

Solution

Consider the workarounds below and consult your vendor.

Block packets with illogical source addresses

Blocking traffic that originates from unlikely or illogical source addresses (such as addresses which are not on-link or logically part of a network assigned to an interface, such as the antispoof keyword in pf) will protect against this vulnerability. This workaround may cause unintended side-effects such as breaking some non-typical configurations. Vendors may also implement this workaround as a fix.

Use application layer encryption

Applications that use secure authentication and encryption such as https, ssh, and ipsec can mitigate this vulnerability by preventing an attacker from intercepting or parsing any data that received. Note that an attacker will probably still be able to blackhole IP addresses resulting in a local denial of service regardless of the authentication or encryption methods used. As noted in RFC 3971, it is non-trivial to use ipsec to protect the integrity of NDP messages.

Design and deploy segmented networks

In a single IPv6 prefix there are certain trust asumptions and if the same IP range is shared all clients will be considered on-link. Segmenting networks will reduce the likelihood of this and similar vulnerabilities from being exploited. Networks can be segmented by assigning unique prefixes to individual router interfaces or by using VLANs.

Systems Affected (Learn More)

VendorStatusDate NotifiedDate Updated
Apple Computer, Inc.Affected30 Jul 200812 Mar 2009
Extreme NetworksAffected30 Jul 200827 Apr 2009
Force10 Networks, Inc.Affected30 Jul 200830 Sep 2008
FreeBSD, Inc.Affected30 Jul 200802 Oct 2008
IBM Corporation (zseries)Affected30 Jul 200805 Aug 2008
Juniper Networks, Inc.Affected30 Jul 200802 Oct 2008
NetBSDAffected30 Jul 200829 Oct 2008
OpenBSDAffected30 Jul 200803 Oct 2008
Wind River Systems, Inc.Affected30 Jul 200803 Nov 2008
3com, Inc.Not Affected30 Jul 200829 Sep 2008
Cisco Systems, Inc.Not Affected30 Jul 200807 Nov 2008
Computer AssociatesNot Affected30 Jul 200802 Oct 2008
Computer Associates eTrust Security ManagementNot Affected30 Jul 200802 Oct 2008
D-Link Systems, Inc.Not Affected30 Jul 200829 Sep 2008
Debian GNU/LinuxNot Affected30 Jul 200802 Oct 2008
If you are a vendor and your product is affected, let us know.View More »

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A

References

Credit

Thanks to David Miles for reporting this vulnerability. Numerous vendors and others also provided technical information that was used in this report.

This document was written by Ryan Giobbi, Evan Wright, Chad Dougherty, and Art Manion.

Other Information

  • CVE IDs: CVE-2008-4404 CVE-2008-2476
  • Date Public: 02 Oct 2008
  • Date First Published: 02 Oct 2008
  • Date Last Updated: 27 Apr 2009
  • Severity Metric: 2.70
  • Document Revision: 99

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.