Re: [OSPF] Dropping malformed LSAs (was: OSPF - Owning the Routing Table Attack)

[Acee Lindem <[e-mail]>]

On 8/4/13 6:06 AM, "David Lamparter" <[e-mail]> wrote:

>On Fri, Aug 02, 2013 at 10:11:01PM +0530, Glen Kent wrote:
>> Does anybody have details on what this OSPF vulnerability is?
>> 
>> https://www.blackhat.com/us-13/briefings.html#Nakibly
>
>As people may have noticed by now (the embargo on providing details has
>expired as the talk was presented), this issue consists of Router LSAs
>where the Router ID is different from the Link State ID.  As such, this
>attack is implementable from any router in an OSPF area against any
>other router in the OSPF.
>
>(Quite honestly, IMHO this is seriously far fetched.  If your control
>plane got compromised this far you have other problems.)

I agree that once the OSPF control plane is open, you are susceptible to
many attacks. However, this attack is a bit more insidious than most since
the actual OSPF router corresponding to the link state ID will most likely
not recognize the LSA as self-originated and re-originate a more recent
version when the malformed one is received. Hence, the malicious LSA will
remain in the routing domain and, depending upon the OSPF implementation,
could result in traffic being redirected.

>
>While Quagga is unaffected by this, we've implemented a warning.  We're
>also considering dropping the LSA outright, but I'm somewhat split on
>that (tilted towards dropping).  I'd be interested if the WG has
>comments on that?

I can't speak for the WG but my implementation will skip the LSA in the
Link-State Update packet.

Thanks,
Acee


>
>
>-David
>_______________________________________________
>OSPF mailing list
>[e-mail]
>https://www.ietf.org/mailman/listinfo/ospf