|
|
|
View Notes By
|
|
|
|
Other Documents
|
|
|
|
|
Vulnerability Note VU#929656
Multiple BGP implementations do not properly handle UPDATE messages
OverviewBGP implementations from multiple vendors including Juniper may not properly handle specially crafted BGP UPDATE messages. These vulnerabilities could allow an unauthenticated, remote attacker to cause a denial of service. Disrupting BGP communication could lead to routing instability.
I. DescriptionThe Border Gateway Protocol (BGP, RFC 4271) is a widely used inter-Autonomous System routing protocol. BGP communication among peer routers is critical to the stable operation of the internet. Multiple vendors BGP implementations do not properly handle specially crafted BGP UPDATE messages. A vulnerable BGP implementation could drop sessions when processing crafted UPDATE messages. A persistent attack could lead to routing instability (route flapping). To affect a BGP session, an attacker would need to succesfully inject a specially crafted packet into an existing BGP session or the underlying TCP session (179/tcp). In other words, the attacker would need to have a valid, configured BGP session or be able to spoof TCP traffic.
This vulnerability was first announced as affecting Juniper routers. Further investigation indicates that other vendors are affected by the same or similar issues. Please see the Systems Affected section below.
II. ImpactA remote attacker could cause a denial of service by injecting a specially crafted BGP UPDATE message into a legitimate BGP session. An attacker with a configured BGP session could attack targets several BGP hops away, or an attacker could spoof TCP traffic.
III. SolutionUpgrade
Upgrade your BGP software as appropriate. Please see the Systems Affected section below for information about specific vendors.
In order to send a specially crafted BGP UPDATE message, an attacker must have or spoof a valid BGP connection. The following workarounds and other BGP security techniques may provide some defense against spoofed connections, however spoofed connections may not be a realistic threat scenario, and the more correct resolution is to upgrade.
Authenticate BGP Traffic
Use TCP MD5 to authenticate BGP traffic (RFC 2385). Only allow BGP traffic from authorized peers.
Restrict BGP Access
Restrict BGP network access to authorized peers. If possible, run BGP on management networks, not transit networks. More information about BGP security (including secure BGP configuration templates) is available from the Team Cymru Reading Room.
Systems Affected
| Vendor | Status | Date Updated |
|---|
| 3com, Inc. | Unknown | 13-Dec-2007 |
| ACCESS | Not Vulnerable | 20-May-2008 |
| Alcatel | Unknown | 13-Dec-2007 |
| AT&T | Unknown | 13-Dec-2007 |
| Avaya, Inc. | Unknown | 13-Dec-2007 |
| Avici Systems, Inc. | Vulnerable | 28-Apr-2008 |
| Century Systems Inc. | Vulnerable | 28-Apr-2008 |
| Charlotte's Web Networks | Unknown | 13-Dec-2007 |
| Check Point Software Technologies | Unknown | 13-Dec-2007 |
| Cisco Systems, Inc. | Not Vulnerable | 6-May-2008 |
| D-Link Systems, Inc. | Unknown | 13-Dec-2007 |
| Data Connection, Ltd. | Unknown | 13-Dec-2007 |
| Extreme Networks | Unknown | 13-Dec-2007 |
| F5 Networks, Inc. | Unknown | 13-Dec-2007 |
| Force10 Networks, Inc. | Not Vulnerable | 22-Feb-2008 |
| Foundry Networks, Inc. | Not Vulnerable | 28-Apr-2008 |
| Fujitsu | Not Vulnerable | 28-Apr-2008 |
| GNU Zebra | Not Vulnerable | 20-May-2008 |
| Hitachi | Vulnerable | 20-May-2008 |
| Hyperchip | Unknown | 13-Dec-2007 |
| IBM Corporation | Unknown | 13-Dec-2007 |
| Ingrian Networks, Inc. | Unknown | 13-Dec-2007 |
| Intel Corporation | Unknown | 8-Apr-2008 |
| IP Infusion, Inc. | Not Vulnerable | 20-May-2008 |
| Juniper Networks, Inc. | Vulnerable | 1-May-2008 |
| Lucent Technologies | Unknown | 13-Dec-2007 |
| Luminous Networks | Unknown | 13-Dec-2007 |
| Multinet (owned Process Software Corporation) | Unknown | 13-Dec-2007 |
| Multitech, Inc. | Unknown | 13-Dec-2007 |
| NEC Corporation | Vulnerable | 6-Jun-2008 |
| Network Appliance, Inc. | Not Vulnerable | 14-Dec-2007 |
| NextHop Technologies, Inc. | Unknown | 13-Dec-2007 |
| Nokia | Unknown | 8-Apr-2008 |
| Nortel Networks, Inc. | Unknown | 13-Dec-2007 |
| OpenBSD | Unknown | 22-Feb-2008 |
| Quagga | Not Vulnerable | 28-Apr-2008 |
| Redback Networks, Inc. | Unknown | 13-Dec-2007 |
| Riverstone Networks, Inc. | Unknown | 13-Dec-2007 |
| Sun Microsystems, Inc. | Not Vulnerable | 28-Apr-2008 |
| Wind River Systems, Inc. | Unknown | 13-Dec-2007 |
| Yamaha Corporation | Vulnerable | 28-Apr-2008 |
| ZyXEL | Unknown | 13-Dec-2007 |
References
http://www.kb.cert.org/vuls/id/415294
http://tools.ietf.org/html/rfc4271
http://www.iana.org/assignments/bgp-parameters
http://tools.ietf.org/html/rfc2385
http://tools.ietf.org/html/rfc2439
http://secunia.com/advisories/28100/
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-6372
https://www.juniper.net/alerts/viewalert.jsp?actionBtn=Search&txtAlertNumber=PSN-2007-12-008&viewMod%20e=view
http://isc.sans.org/diary.php?storyid=3748
https://puck.nether.net/pipermail/juniper-nsp/2007-December/009294.html
https://puck.nether.net/pipermail/juniper-nsp/2007-December/009299.html
http://jvn.jp/cert/JVNVU929656/index.html
http://osvdb.org/show/osvdb/39157
http://www.securityfocus.com/bid/26869
http://www.frsirt.com/english/advisories/2007/4223
http://securitytracker.com/alerts/2007/Dec/1019100.html
http://www.team-cymru.org/?sec=13&opt=28
http://secunia.com/advisories/30028/
Credit
Thanks to members of the Juniper Security Incident Response Team for help in preparing this document.
This document was written by Art Manion.
Other Information
| Date Public | 12/12/2007 |
| Date First Published | 05/06/2008 02:30:49 PM |
| Date Last Updated | 06/06/2008 |
| CERT Advisory | |
| CVE Name | CVE-2007-6372 |
| US-CERT Technical Alerts | |
| Metric | 24.49 |
| Document Revision | 54 |
If you have feedback, comments, or additional information about this vulnerability, please send us
email.
|
|
Get Adobe Reader