SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Networking Stack (TCP/IP)  >   XORP Vendors:   xorp.org
XORP OSPF Link State Advertisement Validation Error Lets Remote Users Deny Service
SecurityTracker Alert ID:  1017079
SecurityTracker URL:  http://securitytracker.com/id/1017079
CVE Reference:   CVE-2006-5425   (Links to External Site)
Updated:  Jun 3 2008
Original Entry Date:  Oct 18 2006
Impact:   Denial of service via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 1.2, 1.3
Description:   A vulnerability was reported in XORP. A remote user can cause denial of service conditions.

A remote user can send a specially crafted OSPF Link State Advertisement (LSA) length field value to cause the target OSPF daemon to crash.

The vendor was notified on October 13, 2006.

This vulnerability was discovered by the Mu Security research team.

Impact:   A remote user can cause denial of service conditions.
Solution:   The vendor has issued a fix and has provided the following solution information [quoted].

Apply the relevant patch to your XORP system and restart OSPF.

1) To patch your present system:

[XORP 1.2]
# wget http://www.xorp.org/patches/SA-06:01/xorp_sa_06:01.ospf_1.2.patch

[XORP 1.3]
# wget http://www.xorp.org/patches/SA-06:01/xorp_sa_06:01.ospf_1.3.patch

2) Execute the following commands (only the last one has to be as root):

# cd xorp
# patch -p0 < /path/to/patch
# gmake
# cd ospf
# gmake install

3) Restart OSPFv2

a) Save the current configuration to a file.

# xorpsh
Xorp> configure
XORP# save /tmp/xorp.boot

b) Delete ospf4 from the configuration and commit. OSPFv2 should no
longer be running.

XORP# delete protocols ospf4
XORP# commit

c) Reload the saved configuration, which will restart OSPFv2
XORP# load /tmp/xorp.boot

The vendor's advisory is available at:

http://www.xorp.org/advisories/XORP_SA_06:01.ospf.txt

Vendor URL:  www.xorp.org/advisories/XORP_SA_06:01.ospf.txt (Links to External Site)
Cause:   Exception handling error, Input validation error

Message History:   None.


 Source Message Contents

Subject:  [Full-disclosure] (no subject)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Denial of Service in XORP OSPFv2 [MU-200610-01]
October 17, 2006

http://labs.musecurity.com/advisories.html

Affected Product/Versions:

XORP OSPFv2 1.2, 1.3

Product Overview:

"XORP is the eXtensible Open Router Platform.

Our goal is to develop an open source software router platform that is stable
and fully featured enough for production use, and flexible and extensible enough
to enable network research. Currently XORP implements routing protocols for IPv4
and IPv6 and a unified means to configure them."

Vulnerability Details:

OSPF carries link state information using Link State Advertisements.  Each
LSA contains a length field as well as a checksum.

XORP performs a checksum verification when processing an LSA.  During the
checksum verification, the length field is used to calculate the payload.
An invalid length field causes an out of bounds read, causing the OSPF daemon
to crash.

Vendor Response / Solution:

Apply the relevant patch to your XORP system and follow vendor instructions.

[XORP 1.2]
# wget http://www.xorp.org/patches/SA-06:01/xorp_sa_06:01.ospf_1.2.patch

[XORP 1.3]
# wget http://www.xorp.org/patches/SA-06:01/xorp_sa_06:01.ospf_1.3.patch

Mu Security would like to thank XORP for timely remediation of this
vulnerability.

History:

10/13/06 - First contact with vendor
10/16/06 - Patch available
10/17/06 - Advisory released

Credit:

This vulnerability was discovered by the Mu Security research team.

http://labs.musecurity.com/pgpkey.txt

Mu Security offers a new class of security analysis system, delivering a
rigorous and streamlined methodology for verifying the robustness and security
readiness of any IP-based product or application. Founded by the pioneers of
intrusion detection and prevention technology, Mu Security is backed by
preeminent venture capital firms that include Accel Partners, Benchmark
Capital and DAG Ventures. The company is headquartered in Sunnyvale, CA. For
more information, visit the company's website at http://www.musecurity.com.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (Darwin)

iD8DBQFFNUJ4Ml+docYeP+YRAroCAJ92uQQMjbdsQhY30snYXmU5oZpiDQCfcXuH
05TaD1EHyE16qFh9ZD1/xyE=
=PBU6
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC