Network technologies and trends

Aug 2 2013   9:25AM GMT

Multiple Cisco Products are affected by OSPF LSA Manipulation Vulnerability

Yasir Irfan Yasir Irfan Profile: Yasir Irfan

The recent security advisory suggests that multiple Cisco products are affected by a vulnerability involving the Open Shortest Path First (OSPF) Routing Protocol Link State Advertisement (LSA) database. With the help of this vulnerability an unauthenticated attacker can take control of the OSPF Autonomous System (AS) domain routing table, backhole traffic and intercept traffic. Which could cause a huge damage to the attacked network.

The attacker could trigger this vulnerability by injecting crafted OSPF packets. Successful exploitation could cause flushing of the routing table on a targeted router, as well as propagation of the crafted OSPF LSA type 1 update throughout the OSPF AS domain.

To exploit this vulnerability, an attacker must accurately determine certain parameters within the LSA database on the target router. This vulnerability can only be triggered by sending crafted unicast or multicast LSA type 1 packets. No other LSA type packets can trigger this vulnerability.

The good news is that the OSPFv3 is not affected by this vulnerability. Fabric Shortest Path First (FSPF) protocol is also not affected by this vulnerability.

All versions of Cisco NX-OS Software are also affected by the vulnerability. There are currently no official fixed releases available on Cisco.com, but interim releases may be available through Cisco Technical Assistance Center (TAC). Customers with service contracts should contact Cisco support organization to get the interim update.

Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are available. This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130801-lsaospf

 Comment on this Post

 
There was an error processing your information. Please try again later.
Thanks. We'll let you know when a new response is added.
Send me notifications when other members comment.

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy

Forgot Password

No problem! Submit your e-mail address below. We'll send you an e-mail containing your password.

Your password has been sent to: