BGP implementations from multiple vendors including Juniper may not properly handle specially crafted BGP UPDATE messages. These vulnerabilities could allow an unauthenticated, remote attacker to cause a denial of service. Disrupting BGP communication could lead to routing instability.
The Border Gateway Protocol (BGP, RFC 4271) is a widely used inter-Autonomous System routing protocol. BGP communication among peer routers is critical to the stable operation of the internet. Multiple vendors BGP implementations do not properly handle specially crafted BGP UPDATE messages. A vulnerable BGP implementation could drop sessions when processing crafted UPDATE messages. A persistent attack could lead to routing instability (route flapping). To affect a BGP session, an attacker would need to succesfully inject a specially crafted packet into an existing BGP session or the underlying TCP session (179/tcp). In other words, the attacker would need to have a valid, configured BGP session or be able to spoof TCP traffic.
This vulnerability was first announced as affecting Juniper routers. Further investigation indicates that other vendors are affected by the same or similar issues. Please see the Systems Affected section below.
A remote attacker could cause a denial of service by injecting a specially crafted BGP UPDATE message into a legitimate BGP session. An attacker with a configured BGP session could attack targets several BGP hops away, or an attacker could spoof TCP traffic.
Avici Systems, Inc. Affected
Century Systems Inc. Affected
Extreme Networks Affected
Juniper Networks, Inc. Affected
NEC Corporation Affected
Yamaha Corporation Affected
ACCESS Not Affected
Cisco Systems, Inc. Not Affected
Force10 Networks, Inc. Not Affected
Foundry Networks, Inc. Not Affected
Fujitsu Not Affected
GNU Zebra Not Affected
IP Infusion, Inc. Not Affected
Network Appliance, Inc. Not Affected
Quagga Not Affected
Sun Microsystems, Inc. Not Affected
3com, Inc. Unknown
Avaya, Inc. Unknown
Charlotte's Web Networks Unknown
D-Link Systems, Inc. Unknown
Data Connection, Ltd. Unknown
F5 Networks, Inc. Unknown
IBM Corporation Unknown
Ingrian Networks, Inc. Unknown
Intel Corporation Unknown
Lucent Technologies Unknown
Luminous Networks Unknown
Multitech, Inc. Unknown
NextHop Technologies, Inc. Unknown
Nortel Networks, Inc. Unknown
Redback Networks, Inc. Unknown
Riverstone Networks, Inc. Unknown
Wind River Systems, Inc. Unknown
Thanks to members of the Juniper Security Incident Response Team for help in preparing this document.
This document was written by Art Manion.
|Date First Published:||2008-05-01|
|Date Last Updated:||2009-06-09 21:52 UTC|