Executive Summary

Summary
Title Multiple BGP implementations do not properly handle UPDATE messages
Informations
Name VU#929656 First vendor Publication 2008-05-01
Vendor VU-CERT Last vendor Modification 2008-06-06
Severity (Vendor) N/A Revision M

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:N/I:N/A:C)
Cvss Base Score 7.8 Attack Range Network
Cvss Impact Score 6.9 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Vulnerability Note VU#929656

Multiple BGP implementations do not properly handle UPDATE messages

Overview

BGP implementations from multiple vendors including Juniper may not properly handle specially crafted BGP UPDATE messages. These vulnerabilities could allow an unauthenticated, remote attacker to cause a denial of service. Disrupting BGP communication could lead to routing instability.

I. Description

The Border Gateway Protocol (BGP, RFC 4271) is a widely used inter-Autonomous System routing protocol. BGP communication among peer routers is critical to the stable operation of the internet. Multiple vendors BGP implementations do not properly handle specially crafted BGP UPDATE messages. A vulnerable BGP implementation could drop sessions when processing crafted UPDATE messages. A persistent attack could lead to routing instability (route flapping). To affect a BGP session, an attacker would need to succesfully inject a specially crafted packet into an existing BGP session or the underlying TCP session (179/tcp). In other words, the attacker would need to have a valid, configured BGP session or be able to spoof TCP traffic.

This vulnerability was first announced as affecting Juniper routers. Further investigation indicates that other vendors are affected by the same or similar issues. Please see the Systems Affected section below.

II. Impact

A remote attacker could cause a denial of service by injecting a specially crafted BGP UPDATE message into a legitimate BGP session. An attacker with a configured BGP session could attack targets several BGP hops away, or an attacker could spoof TCP traffic.

III. Solution

Upgrade

Upgrade your BGP software as appropriate. Please see the Systems Affected section below for information about specific vendors.

In order to send a specially crafted BGP UPDATE message, an attacker must have or spoof a valid BGP connection. The following workarounds and other BGP security techniques may provide some defense against spoofed connections, however spoofed connections may not be a realistic threat scenario, and the more correct resolution is to upgrade.

Authenticate BGP Traffic
Use TCP MD5 to authenticate BGP traffic (RFC 2385). Only allow BGP traffic from authorized peers.

Restrict BGP Access
Restrict BGP network access to authorized peers. If possible, run BGP on management networks, not transit networks. More information about BGP security (including secure BGP configuration templates) is available from the Team Cymru Reading Room.

Systems Affected

VendorStatusDate Updated
3com, Inc.Unknown13-Dec-2007
ACCESSNot Vulnerable20-May-2008
AlcatelUnknown13-Dec-2007
AT&TUnknown13-Dec-2007
Avaya, Inc.Unknown13-Dec-2007
Avici Systems, Inc.Vulnerable28-Apr-2008
Century Systems Inc.Vulnerable28-Apr-2008
Charlotte's Web NetworksUnknown13-Dec-2007
Check Point Software TechnologiesUnknown13-Dec-2007
Cisco Systems, Inc.Not Vulnerable6-May-2008
D-Link Systems, Inc.Unknown13-Dec-2007
Data Connection, Ltd.Unknown13-Dec-2007
Extreme NetworksUnknown13-Dec-2007
F5 Networks, Inc.Unknown13-Dec-2007
Force10 Networks, Inc.Not Vulnerable22-Feb-2008
Foundry Networks, Inc.Not Vulnerable28-Apr-2008
FujitsuNot Vulnerable28-Apr-2008
GNU ZebraNot Vulnerable20-May-2008
HitachiVulnerable20-May-2008
HyperchipUnknown13-Dec-2007
IBM CorporationUnknown13-Dec-2007
Ingrian Networks, Inc.Unknown13-Dec-2007
Intel CorporationUnknown8-Apr-2008
IP Infusion, Inc.Not Vulnerable20-May-2008
Juniper Networks, Inc.Vulnerable1-May-2008
Lucent TechnologiesUnknown13-Dec-2007
Luminous NetworksUnknown13-Dec-2007
Multinet (owned Process Software Corporation)Unknown13-Dec-2007
Multitech, Inc.Unknown13-Dec-2007
NEC CorporationVulnerable6-Jun-2008
Network Appliance, Inc.Not Vulnerable14-Dec-2007
NextHop Technologies, Inc.Unknown13-Dec-2007
NokiaUnknown8-Apr-2008
Nortel Networks, Inc.Unknown13-Dec-2007
OpenBSDUnknown22-Feb-2008
QuaggaNot Vulnerable28-Apr-2008
Redback Networks, Inc.Unknown13-Dec-2007
Riverstone Networks, Inc.Unknown13-Dec-2007
Sun Microsystems, Inc.Not Vulnerable28-Apr-2008
Wind River Systems, Inc.Unknown13-Dec-2007
Yamaha CorporationVulnerable28-Apr-2008
ZyXELUnknown13-Dec-2007

References

http://www.kb.cert.org/vuls/id/415294
http://tools.ietf.org/html/rfc4271
http://www.iana.org/assignments/bgp-parameters
http://tools.ietf.org/html/rfc2385
http://tools.ietf.org/html/rfc2439
http://secunia.com/advisories/28100/
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-6372
https://www.juniper.net/alerts/viewalert.jsp?actionBtn=Search&txtAlertNumber=PSN-2007-12-008&viewMod%20e=view
http://isc.sans.org/diary.php?storyid=3748
https://puck.nether.net/pipermail/juniper-nsp/2007-December/009294.html
https://puck.nether.net/pipermail/juniper-nsp/2007-December/009299.html
http://jvn.jp/cert/JVNVU929656/index.html
http://osvdb.org/show/osvdb/39157
http://www.securityfocus.com/bid/26869
http://www.frsirt.com/english/advisories/2007/4223
http://securitytracker.com/alerts/2007/Dec/1019100.html
http://www.team-cymru.org/?sec=13&opt=28
http://secunia.com/advisories/30028/

Credit

Thanks to members of the Juniper Security Incident Response Team for help in preparing this document.

This document was written by Art Manion.

Other Information

Date Public12/12/2007
Date First Published05/06/2008 02:30:49 PM
Date Last Updated06/06/2008
CERT Advisory 
CVE NameCVE-2007-6372
US-CERT Technical Alerts 
Metric24.49
Document Revision54

Original Source

Url : http://www.kb.cert.org/vuls/id/929656

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-20 Improper Input Validation

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 1
Hardware 1
Hardware 1
Hardware 1
Hardware 5
Hardware 1
Hardware 1
Os 9

Open Source Vulnerability Database (OSVDB)

Id Description
45434 Yamaha Routers Malformed BGP Update Message Remote DoS
45433 Hitachi GR Routers Malformed BGP Update Message Remote DoS
45432 AlaxalA AX Routers Malformed BGP Update Message Remote DoS
45431 Century Routers Malformed BGP Update Message Remote DoS
45430 Avici Routers Malformed BGP Update Message Remote DoS
44947 ALAXALA Networks AX Series Malformed BGP Update Message Remote DoS
44942 Hitachi GR Series Malformed BGP Update Message Remote DoS
39158 Juniper Junos IPv6 Traffic Handling Unspecified Remote Overflow DoS

Juniper Junos contains a flaw that may allow a remote denial of service. The issue is triggered due to a specially crafted IPv6 packet, and will result in a memory leak in the kernel and a loss of availability for the platform.
39157 Juniper Junos Malformed BGP Update Message Remote DoS