Vulnerability Note VU#929656

BGP implementations do not properly handle UPDATE messages

Original Release date: 06 May 2008 | Last revised: 09 Jun 2009

Overview

BGP implementations from multiple vendors including Juniper may not properly handle specially crafted BGP UPDATE messages. These vulnerabilities could allow an unauthenticated, remote attacker to cause a denial of service. Disrupting BGP communication could lead to routing instability.

Description

The Border Gateway Protocol (BGP, RFC 4271) is a widely used inter-Autonomous System routing protocol. BGP communication among peer routers is critical to the stable operation of the internet. Multiple vendors BGP implementations do not properly handle specially crafted BGP UPDATE messages. A vulnerable BGP implementation could drop sessions when processing crafted UPDATE messages. A persistent attack could lead to routing instability (route flapping). To affect a BGP session, an attacker would need to succesfully inject a specially crafted packet into an existing BGP session or the underlying TCP session (179/tcp). In other words, the attacker would need to have a valid, configured BGP session or be able to spoof TCP traffic.

This vulnerability was first announced as affecting Juniper routers. Further investigation indicates that other vendors are affected by the same or similar issues. Please see the Systems Affected section below.

Impact

A remote attacker could cause a denial of service by injecting a specially crafted BGP UPDATE message into a legitimate BGP session. An attacker with a configured BGP session could attack targets several BGP hops away, or an attacker could spoof TCP traffic.

Solution

Upgrade
Upgrade your BGP software as appropriate. Please see the Systems Affected section below for information about specific vendors.


In order to send a specially crafted BGP UPDATE message, an attacker must have or spoof a valid BGP connection. The following workarounds and other BGP security techniques may provide some defense against spoofed connections, however spoofed connections may not be a realistic threat scenario, and the more correct resolution is to upgrade.

Authenticate BGP Traffic

Use TCP MD5 to authenticate BGP traffic (RFC 2385). Only allow BGP traffic from authorized peers. It is generally recognized that TCP MD5

Restrict BGP Access

Restrict BGP network access to authorized peers. If possible, run BGP on management networks, not transit networks. More information about BGP security (including secure BGP configuration templates) is available from the Team Cymru Reading Room.

Systems Affected (Learn More)

VendorStatusDate NotifiedDate Updated
Avici Systems, Inc.Affected13 Dec 200728 Apr 2008
Century Systems Inc.Affected-28 Apr 2008
Extreme NetworksAffected13 Dec 200708 Jun 2009
HitachiAffected13 Dec 200712 Aug 2008
Juniper Networks, Inc.Affected16 Jan 200801 May 2008
NEC CorporationAffected-06 Jun 2008
Yamaha CorporationAffected-28 Apr 2008
ACCESSNot Affected-20 May 2008
Cisco Systems, Inc.Not Affected13 Dec 200706 May 2008
Force10 Networks, Inc.Not Affected13 Dec 200722 Feb 2008
Foundry Networks, Inc.Not Affected13 Dec 200728 Apr 2008
FujitsuNot Affected-28 Apr 2008
GNU ZebraNot Affected-20 May 2008
IP Infusion, Inc.Not Affected22 Feb 200820 May 2008
Network Appliance, Inc.Not Affected13 Dec 200714 Dec 2007
If you are a vendor and your product is affected, let us know.View More »

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A

References

Credit

Thanks to members of the Juniper Security Incident Response Team for help in preparing this document.

This document was written by Art Manion.

Other Information

  • CVE IDs: CVE-2007-6372
  • Date Public: 12 Dec 2007
  • Date First Published: 06 May 2008
  • Date Last Updated: 09 Jun 2009
  • Severity Metric: 24.49
  • Document Revision: 57

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.