CWE-694: Use of Multiple Resources with a Duplicate Identifier

The OSPF protocol requires LSA's to be identified by: LS Type, Advertising Router, and Link State ID. However, during the routing table calculation phase, the specification states that a LSA is queried in the LSA database
using only the Link State ID. Since the Link State ID is used in the LSA database to identify a particular router, a malformed duplicate entry can cause an implementation-specific activity to occur.

In some implementations, the vulnerability can allow an attacker to subvert the routing table of victim router by sending false link state advertisements on behalf of other routers. This subversion can cause the victim router
to drop the entire table (Denial of Service) or to re-route traffic on the network.

This vulnerability can allow an attacker to re-route traffic, compromising the confidentiality of the data, or to conduct a Denial of Service attack against a router, dropping all traffic.

Install Updates
The OSPF protocol is a popular interior routing protocol that is used by many devices made by multiple manufacturers. This vulnerability is implementation specific, so some vendors may not be affected. The list below contains known affected or non-affected vendors. Please consult your network equipment vendor for confirmation that they are not affected by this vulnerability.