Posted by: Yasir Irfan
Cisco NX-OS software, Cisco Systems, Cisco Technical Assistance Center, Cisco Tips, Fabric Shortest Path First, Link State Advertisemen, Multiple Cisco Products are affected by OSPF LSA Manipulation Vulnerability, Network Technologies and Trends, Networking, Open Shortest Path First, OSPF Autonomous System, OSPF LSA type 1, OSPF packets, OSPFv3, routing table, unauthenticated attacker, vulnerability
The recent security advisory suggests that multiple Cisco products are affected by a vulnerability involving the Open Shortest Path First (OSPF) Routing Protocol Link State Advertisement (LSA) database. With the help of this vulnerability an unauthenticated attacker can take control of the OSPF Autonomous System (AS) domain routing table, backhole traffic and intercept traffic. Which could cause a huge damage to the attacked network.
The attacker could trigger this vulnerability by injecting crafted OSPF packets. Successful exploitation could cause flushing of the routing table on a targeted router, as well as propagation of the crafted OSPF LSA type 1 update throughout the OSPF AS domain.
To exploit this vulnerability, an attacker must accurately determine certain parameters within the LSA database on the target router. This vulnerability can only be triggered by sending crafted unicast or multicast LSA type 1 packets. No other LSA type packets can trigger this vulnerability.
The good news is that the OSPFv3 is not affected by this vulnerability. Fabric Shortest Path First (FSPF) protocol is also not affected by this vulnerability.
All versions of Cisco NX-OS Software are also affected by the vulnerability. There are currently no official fixed releases available on Cisco.com, but interim releases may be available through Cisco Technical Assistance Center (TAC). Customers with service contracts should contact Cisco support organization to get the interim update.
Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are available. This advisory is available at the following link: