BGP implementations from multiple vendors including Juniper may not properly handle specially crafted BGP UPDATE messages. These vulnerabilities could allow an unauthenticated, remote attacker to cause a denial of service. Disrupting BGP communication could lead to routing instability.
The Border Gateway Protocol (BGP, RFC 4271) is a widely used inter-Autonomous System routing protocol. BGP communication among peer routers is critical to the stable operation of the internet. Multiple vendors BGP implementations do not properly handle specially crafted BGP UPDATE messages. A vulnerable BGP implementation could drop sessions when processing crafted UPDATE messages. A persistent attack could lead to routing instability (route flapping). To affect a BGP session, an attacker would need to succesfully inject a specially crafted packet into an existing BGP session or the underlying TCP session (179/tcp). In other words, the attacker would need to have a valid, configured BGP session or be able to spoof TCP traffic.
This vulnerability was first announced as affecting Juniper routers. Further investigation indicates that other vendors are affected by the same or similar issues. Please see the Systems Affected section below.
A remote attacker could cause a denial of service by injecting a specially crafted BGP UPDATE message into a legitimate BGP session. An attacker with a configured BGP session could attack targets several BGP hops away, or an attacker could spoof TCP traffic.
Avici Systems, Inc.
Century Systems Inc.
Juniper Networks, Inc.
Cisco Systems, Inc.
Force10 Networks, Inc.
Foundry Networks, Inc.
IP Infusion, Inc.
Network Appliance, Inc.
Sun Microsystems, Inc.
Charlotte's Web Networks
Check Point Software Technologies
D-Link Systems, Inc.
Data Connection, Ltd.
F5 Networks, Inc.
Ingrian Networks, Inc.
Multinet (owned Process Software Corporation)
NextHop Technologies, Inc.
Nortel Networks, Inc.
Redback Networks, Inc.
Riverstone Networks, Inc.
Wind River Systems, Inc.
Thanks to members of the Juniper Security Incident Response Team for help in preparing this document.
This document was written by Art Manion.
|Date First Published:||2008-05-06|
|Date Last Updated:||2009-06-09 21:52 UTC|