INFORMATION BULLETIN
INFORMATION BULLETIN
| PROBLEM: | Boorder Gateway Protocol (BGP) implementations from multiple vendors including Juniper may not properly handle specially crafted BGP UPDATE messages. These vulnerabilities could allow an unauthenticated, remote attacker to cause a denial of service. Disrupting BGP communication could lead to routing instability. |
| SYSTEMS AFFECTED: |
Avici Systems, Inc. Century Systems, Inc. Hitachi Juniper Networks, Inc. Yamaha Corporation |
| DAMAGE: | Remote DoS. |
| SOLUTION: | Upgrade to the appropriate version. |
| VULNERABILITY ASSESSMENT: |
The risk is LOW. A remote attacker could cause a denial of servcie by injecting a specially crafted BGP UPDATE message into a legitimate BGP session. An attacker with a configured BGP session could attack targets several BGP hops away, or an attacker could spoof TCP traffic. |
| CVSS 2 BASE SCORE: TEMPORAL SCORE: VECTOR: |
5.4 4.2 (AV:N/AC:H/Au:N/C:N/I:N/A:C/E:POC/RL:OF/RC:C) |
| LINKS: | |
| CIAC BULLETIN: | http://www.ciac.org/ciac/bulletins/s-284.shtml |
| ORIGINAL BULLETIN: | http://www.kb.cert.org/vuls/id/929656#systems |
| CVE: | CVE-2007-6372 |
[***** Start US-CERT Vulnerability Note VU#929656 *****]
Multiple vendors BGP implementations do not properly handle specially crafted BGP UPDATE messages. A vulnerable BGP implementation could drop sessions when processing crafted UPDATE messages. A persistent attack could lead to routing instability (route flapping).
To affect a BGP session, an attacker would need to succesfully inject a specially crafted packet into an existing BGP session or the underlying TCP session (179/tcp). In other words, the attacker would need to have a valid, configured BGP session or be able to spoof TCP traffic.
This vulnerability was first announced as affecting Juniper routers. Further investigation indicates that other vendors are affected by the same or similar issues. Please see the Systems Affected section below.
Upgrade your BGP software as appropriate. Please see the Systems Affected section below for information about specific vendors.
In order to send a specially crafted BGP UPDATE message, an attacker must have or spoof a valid BGP connection. To protect against spoofed TCP connections, consider the following workarounds.
Authenticate BGP Traffic
Use TCP MD5 to authenticate BGP traffic (RFC 2385). Only allow BGP traffic from authorized peers.
Restrict BGP Access
Restrict BGP network access to authorized peers. If possible, run BGP on management networks, not transit networks. More information about BGP security (including secure BGP configuration templates) is available from the Team Cymru Reading Room.
| Vendor | Status | Date Updated |
|---|---|---|
| 3com, Inc. | Unknown | 13-Dec-2007 |
| ACCESS | Not Vulnerable | 1-May-2008 |
| Alcatel | Unknown | 13-Dec-2007 |
| AT&T | Unknown | 13-Dec-2007 |
| Avaya, Inc. | Unknown | 13-Dec-2007 |
| Avici Systems, Inc. | Vulnerable | 28-Apr-2008 |
| Century Systems Inc. | Vulnerable | 28-Apr-2008 |
| Charlotte's Web Networks | Unknown | 13-Dec-2007 |
| Check Point Software Technologies | Unknown | 13-Dec-2007 |
| Cisco Systems, Inc. | Not Vulnerable | 6-May-2008 |
| D-Link Systems, Inc. | Unknown | 13-Dec-2007 |
| Data Connection, Ltd. | Unknown | 13-Dec-2007 |
| Extreme Networks | Unknown | 13-Dec-2007 |
| F5 Networks, Inc. | Unknown | 13-Dec-2007 |
| Force10 Networks, Inc. | Not Vulnerable | 22-Feb-2008 |
| Foundry Networks, Inc. | Not Vulnerable | 28-Apr-2008 |
| Fujitsu | Not Vulnerable | 28-Apr-2008 |
| GNU Zebra | Unknown | 1-May-2008 |
| Hitachi | Vulnerable | 28-Apr-2008 |
| Hyperchip | Unknown | 13-Dec-2007 |
| IBM Corporation | Unknown | 13-Dec-2007 |
| Ingrian Networks, Inc. | Unknown | 13-Dec-2007 |
| Intel Corporation | Unknown | 8-Apr-2008 |
| IP Infusion, Inc. | Unknown | 1-May-2008 |
| Juniper Networks, Inc. | Vulnerable | 1-May-2008 |
| Lucent Technologies | Unknown | 13-Dec-2007 |
| Luminous Networks | Unknown | 13-Dec-2007 |
| Multinet (owned Process Software Corporation) | Unknown | 13-Dec-2007 |
| Multitech, Inc. | Unknown | 13-Dec-2007 |
| Network Appliance, Inc. | Not Vulnerable | 14-Dec-2007 |
| NextHop Technologies, Inc. | Unknown | 13-Dec-2007 |
| Nokia | Unknown | 8-Apr-2008 |
| Nortel Networks, Inc. | Unknown | 13-Dec-2007 |
| OpenBSD | Unknown | 22-Feb-2008 |
| Quagga | Not Vulnerable | 28-Apr-2008 |
| Redback Networks, Inc. | Unknown | 13-Dec-2007 |
| Riverstone Networks, Inc. | Unknown | 13-Dec-2007 |
| Sun Microsystems, Inc. | Not Vulnerable | 28-Apr-2008 |
| Wind River Systems, Inc. | Unknown | 13-Dec-2007 |
| Yamaha Corporation | Vulnerable | 28-Apr-2008 |
| ZyXEL | Unknown | 13-Dec-2007 |
http://www.kb.cert.org/vuls/id/415294
http://tools.ietf.org/html/rfc1771
http://tools.ietf.org/html/rfc4271
http://tools.ietf.org/html/rfc2385
http://tools.ietf.org/html/rfc2439
http://secunia.com/advisories/28100/
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-6372
https://www.juniper.net/alerts/viewalert.jsp?actionBtn=Search&txtAlertNumber=PSN-2007-12-008&viewMod%20e=view
http://isc.sans.org/diary.php?storyid=3748
https://puck.nether.net/pipermail/juniper-nsp/2007-December/009294.html
https://puck.nether.net/pipermail/juniper-nsp/2007-December/009299.html
http://osvdb.org/show/osvdb/39157
http://www.securityfocus.com/bid/26869
http://www.frsirt.com/english/advisories/2007/4223
http://securitytracker.com/alerts/2007/Dec/1019100.html
http://www.team-cymru.org/?sec=13&opt=28
This document was written by Art Manion.
| Date Public | 12/12/2007 |
| Date First Published | 05/06/2008 02:30:49 PM |
| Date Last Updated | 05/06/2008 |
| CERT Advisory | |
| CVE Name | CVE-2007-6372 |
| US-CERT Technical Alerts | |
| Metric | 24.49 |
| Document Revision | 45 |
[***** End US-CERT Vulnerability Note VU#929656 *****]
Voice: +1 925-422-8193 (7 x 24)
FAX: +1 925-423-8002
STU-III: +1 925-423-2604
E-mail: ciac@ciac.org
World Wide Web: http://www.ciac.org/
Anonymous FTP: ftp.ciac.org