Open Shortest Path First (OSPF) Protocol does not specify unique LSA lookup identifer

ronjor · Aug 1, 2013

Original Release date: 01 Aug 2013 | Last revised: 01 Aug 2013

Overview

The Open Shortest Path First (OSPF) protocol does not specify unique Link State Advertisement (LSA) lookup identifiers, which allow an attacker to intercept traffic or conduct a Denial of Service (DoS) attack.

Description

CWE-694: Use of Multiple Resources with a Duplicate Identifier

The OSPF protocol requires LSA's to be identified by: LS Type, Advertising Router, and Link State ID. However, during the routing table calculation phase, the specification states that a LSA is queried in the LSA database
using only the Link State ID. Since the Link State ID is used in the LSA database to identify a particular router, a malformed duplicate entry can cause an implementation-specific activity to occur.

In some implementations, the vulnerability can allow an attacker to subvert the routing table of victim router by sending false link state advertisements on behalf of other routers. This subversion can cause the victim router
to drop the entire table (Denial of Service) or to re-route traffic on the network.
Impact

This vulnerability can allow an attacker to re-route traffic, compromising the confidentiality of the data, or to conduct a Denial of Service attack against a router, dropping all traffic.
Click to expand...

http://www.kb.cert.org/vuls/id/229804

CloneRanger · Aug 1, 2013

Heck of a lot of Unknowns !

https://www.kb.cert.org/vuls/byvendor?searchview&Query=FIELD Reference=229804&SearchOrder=4

Log in or Sign up

Open Shortest Path First (OSPF) Protocol does not specify unique LSA lookup identifer

ronjor Global Moderator

CloneRanger Registered Member

Log in or Sign up

Open Shortest Path First (OSPF) Protocol does not specify unique LSA lookup identifer

ronjor Global Moderator

CloneRanger Registered Member

Useful Searches