Vulnerability Note VU#784540

BGP implementations do not adequately handle malformed BGP OPEN and UPDATE messages

Multiple BGP implementations contain vulnerabilities handling exceptional OPEN and UPDATE messages. While the details of the individual vulnerabilities are different, the impacts appear to be limited to denial of service. In addition, most BGP implementations do not accept messages from arbitrary sources. Some BGP implementations only accept TCP connections (179/tcp) from properly configured peers, and some implementations require a valid AS number in the BGP message data. To deliver malicious messages to such systems, an attacker would need to spoof a TCP connection or have access to a trusted BGP peer. The attacker may also need to know a valid AS number.

For information about specific BGP implementations, please see the Systems Affected section below.

II. Impact

Apply a patch or upgrade as specified by your vendor.

Restrict BGP access

Using access control lists (ACLs) and BGP configuration settings, restrict access to valid networks and BGP peers.

Authenticate BGP messages

TCP MD5 (RFC 2385), IPsec, and S-BGP provide cryptographic authentication of network connections and/or BGP messages. Various performance and key distribution issues are associated with these authentication methods.

Use out-of-band management channels

When possible, use an out-of-band channel, such as a separate network, to transmit BGP other management traffic.

Systems Affected

http://www.ietf.org/rfc/rfc1771.txt
http://www.ietf.org/internet-drafts/draft-ietf-idr-bgp4-experience-protocol-04.txt
http://www.ietf.org/rfc/rfc2385.txt
http://www.net-tech.bbn.com/sbgp/draft-clynn-s-bgp-protocol-01.txt
http://www.nanog.org/mtg-0306/pdf/franz.pdf
http://www.cisco.com/warp/public/707/cisco-sa-20040616-bgp.shtml

Credit

These vulnerabilities were reported as a result of research done by Cisco. Thanks to Cisco for sharing this research and helping to coordinate the disclosure of information about these vulnerabilities.

This document was written by Art Manion.

Other Information

If you have feedback, comments, or additional information about this vulnerability, please send us email.