Home    |    View Topics    |    Search    |    Contact Us    |   



Category:   Networking Stack (TCP/IP)  >   XORP Vendors:
XORP OSPF Link State Advertisement Validation Error Lets Remote Users Deny Service
SecurityTracker Alert ID:  1017079
SecurityTracker URL:
CVE Reference:   CVE-2006-5425   (Links to External Site)
Updated:  Jun 3 2008
Original Entry Date:  Oct 18 2006
Impact:   Denial of service via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 1.2, 1.3
Description:   A vulnerability was reported in XORP. A remote user can cause denial of service conditions.

A remote user can send a specially crafted OSPF Link State Advertisement (LSA) length field value to cause the target OSPF daemon to crash.

The vendor was notified on October 13, 2006.

This vulnerability was discovered by the Mu Security research team.

Impact:   A remote user can cause denial of service conditions.
Solution:   The vendor has issued a fix and has provided the following solution information [quoted].

Apply the relevant patch to your XORP system and restart OSPF.

1) To patch your present system:

[XORP 1.2]
# wget

[XORP 1.3]
# wget

2) Execute the following commands (only the last one has to be as root):

# cd xorp
# patch -p0 < /path/to/patch
# gmake
# cd ospf
# gmake install

3) Restart OSPFv2

a) Save the current configuration to a file.

# xorpsh
Xorp> configure
XORP# save /tmp/xorp.boot

b) Delete ospf4 from the configuration and commit. OSPFv2 should no
longer be running.

XORP# delete protocols ospf4
XORP# commit

c) Reload the saved configuration, which will restart OSPFv2
XORP# load /tmp/xorp.boot

The vendor's advisory is available at:

Vendor URL: (Links to External Site)
Cause:   Exception handling error, Input validation error

Message History:   None.

 Source Message Contents

Subject:  [Full-disclosure] (no subject)

Hash: SHA1

Denial of Service in XORP OSPFv2 [MU-200610-01]
October 17, 2006

Affected Product/Versions:

XORP OSPFv2 1.2, 1.3

Product Overview:

"XORP is the eXtensible Open Router Platform.

Our goal is to develop an open source software router platform that is stable
and fully featured enough for production use, and flexible and extensible enough
to enable network research. Currently XORP implements routing protocols for IPv4
and IPv6 and a unified means to configure them."

Vulnerability Details:

OSPF carries link state information using Link State Advertisements.  Each
LSA contains a length field as well as a checksum.

XORP performs a checksum verification when processing an LSA.  During the
checksum verification, the length field is used to calculate the payload.
An invalid length field causes an out of bounds read, causing the OSPF daemon
to crash.

Vendor Response / Solution:

Apply the relevant patch to your XORP system and follow vendor instructions.

[XORP 1.2]
# wget

[XORP 1.3]
# wget

Mu Security would like to thank XORP for timely remediation of this


10/13/06 - First contact with vendor
10/16/06 - Patch available
10/17/06 - Advisory released


This vulnerability was discovered by the Mu Security research team.

Mu Security offers a new class of security analysis system, delivering a
rigorous and streamlined methodology for verifying the robustness and security
readiness of any IP-based product or application. Founded by the pioneers of
intrusion detection and prevention technology, Mu Security is backed by
preeminent venture capital firms that include Accel Partners, Benchmark
Capital and DAG Ventures. The company is headquartered in Sunnyvale, CA. For
more information, visit the company's website at
Version: GnuPG v1.4.4 (Darwin)


Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia -


Go to the Top of This SecurityTracker Archive Page

Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, LLC