BGP implementations do not properly handle UPDATE messages

Overview

BGP implementations from multiple vendors including Juniper may not properly handle specially crafted BGP UPDATE messages. These vulnerabilities could allow an unauthenticated, remote attacker to cause a denial of service. Disrupting BGP communication could lead to routing instability.

Description

The Border Gateway Protocol (BGP, RFC 4271) is a widely used inter-Autonomous System routing protocol. BGP communication among peer routers is critical to the stable operation of the internet. Multiple vendors BGP implementations do not properly handle specially crafted BGP UPDATE messages. A vulnerable BGP implementation could drop sessions when processing crafted UPDATE messages. A persistent attack could lead to routing instability (route flapping). To affect a BGP session, an attacker would need to succesfully inject a specially crafted packet into an existing BGP session or the underlying TCP session (179/tcp). In other words, the attacker would need to have a valid, configured BGP session or be able to spoof TCP traffic.

This vulnerability was first announced as affecting Juniper routers. Further investigation indicates that other vendors are affected by the same or similar issues. Please see the Systems Affected section below.

---

Impact

A remote attacker could cause a denial of service by injecting a specially crafted BGP UPDATE message into a legitimate BGP session. An attacker with a configured BGP session could attack targets several BGP hops away, or an attacker could spoof TCP traffic.

---

Solution

Upgrade
Upgrade your BGP software as appropriate. Please see the Systems Affected section below for information about specific vendors.

---

In order to send a specially crafted BGP UPDATE message, an attacker must have or spoof a valid BGP connection. The following workarounds and other BGP security techniques may provide some defense against spoofed connections, however spoofed connections may not be a realistic threat scenario, and the more correct resolution is to upgrade.

Authenticate BGP Traffic

Use TCP MD5 to authenticate BGP traffic (RFC 2385). Only allow BGP traffic from authorized peers. It is generally recognized that TCP MD5

Restrict BGP Access

Restrict BGP network access to authorized peers. If possible, run BGP on management networks, not transit networks. More information about BGP security (including secure BGP configuration templates) is available from the Team Cymru Reading Room.

---

Vendor Information

929656

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Avici Systems, Inc. Affected

Notified: December 13, 2007 Updated: April 28, 2008

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Century Systems Inc. Affected

Updated: April 28, 2008

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Extreme Networks __ Affected

Notified: December 13, 2007 Updated: June 08, 2009

Statement Date: May 15, 2009

Status

Affected

Vendor Statement

Extreme Networks products are vulnerable. This issue is being tracked by PD4-708731481.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Hitachi __ Affected

Notified: December 13, 2007 Updated: August 12, 2008

Statement Date: February 24, 2008

Status

Affected

Vendor Statement

AlaxalA Networks AX series and Hitachi GS/GR series are vulnerable to this issue.

AlaxalA Networks AX series
<http://www.alaxala.com/jp/support/security/20080508.html&gt; (Japanese)

Hitachi GS/GR series
<http://www.hitachi.co.jp/Prod/comp/network/notice/BGP_UPDATE.html&gt; (Japanese)

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Juniper Networks, Inc. __ Affected

Notified: January 17, 2008 Updated: May 01, 2008

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

Please see https://www.juniper.net/alerts/viewalert.jsp?actionBtn=Search&txtAlertNumber=PSN-2007-12-008&viewMod%20e=view (login required).

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23929656 Feedback>).

NEC Corporation __ Affected

Updated: June 06, 2008

Statement Date: May 30, 2008

Status

Affected

Vendor Statement

* IP8800/S/R is vulnerable.
* IP38X series is vulnerable.
* Juniper T/M/MX-series router is vulnerable.

For more detail: (only in Japanese)

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Yamaha Corporation Affected

Updated: April 28, 2008

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

ACCESS __ Not Affected

Updated: May 20, 2008

Statement Date: May 09, 2008

Status

Not Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

ACCESS acquired IP Infusion. IP Infusion maintains (or contributes heavily to the maintenance) of Zebra.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23929656 Feedback>).

Cisco Systems, Inc. Not Affected

Notified: December 13, 2007 Updated: May 06, 2008

Status

Not Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Force10 Networks, Inc. __ Not Affected

Notified: December 13, 2007 Updated: February 22, 2008

Statement Date: December 20, 2007

Status

Not Affected

Vendor Statement

Force10 Networks’ switch/router product lines are unaffacted by this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Foundry Networks, Inc. __ Not Affected

Notified: December 13, 2007 Updated: April 28, 2008

Statement Date: January 15, 2008

Status

Not Affected

Vendor Statement

Foundry is not vulnerable. The UPDATE messages in question do not cause Foundry to drop BGP sessions.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Fujitsu Not Affected

Updated: April 28, 2008

Status

Not Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

GNU Zebra __ Not Affected

Updated: May 20, 2008

Statement Date: May 09, 2008

Status

Not Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

ACCESS acquired IP Infusion. IP Infusion maintains (or contributes heavily to the maintenance) of Zebra.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23929656 Feedback>).

IP Infusion, Inc. __ Not Affected

Notified: February 23, 2008 Updated: May 20, 2008

Statement Date: May 09, 2008

Status

Not Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

ACCESS acquired IP Infusion. IP Infusion maintains (or contributes heavily to the maintenance) of Zebra.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23929656 Feedback>).

Network Appliance, Inc. __ Not Affected

Notified: December 13, 2007 Updated: December 14, 2007

Statement Date: December 13, 2007

Status

Not Affected

Vendor Statement

NetApp Products do not implement the BGP protocol.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Quagga Not Affected

Notified: February 23, 2008 Updated: April 28, 2008

Statement Date: February 23, 2008

Status

Not Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Sun Microsystems, Inc. __ Not Affected

Notified: February 22, 2008 Updated: April 28, 2008

Statement Date: April 09, 2008

Status

Not Affected

Vendor Statement

Sun Distributes Quagga BGPD daemon with Solaris 10 which is not vulnerable to these issues.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

3com, Inc. Unknown

Notified: December 13, 2007 Updated: December 13, 2007

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

AT&T Unknown

Notified: December 13, 2007 Updated: December 13, 2007

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Alcatel Unknown

Notified: December 13, 2007 Updated: December 13, 2007

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Avaya, Inc. Unknown

Notified: December 13, 2007 Updated: December 13, 2007

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Charlotte’s Web Networks Unknown

Notified: December 13, 2007 Updated: December 13, 2007

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Check Point Software Technologies Unknown

Notified: December 13, 2007 Updated: December 13, 2007

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

D-Link Systems, Inc. Unknown

Notified: December 13, 2007 Updated: December 13, 2007

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Data Connection, Ltd. Unknown

Notified: December 13, 2007 Updated: December 13, 2007

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

F5 Networks, Inc. Unknown

Notified: December 13, 2007 Updated: December 13, 2007

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Hyperchip Unknown

Notified: December 13, 2007 Updated: December 13, 2007

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

IBM Corporation Unknown

Notified: December 13, 2007 Updated: December 13, 2007

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Ingrian Networks, Inc. Unknown

Notified: December 13, 2007 Updated: December 13, 2007

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Intel Corporation Unknown

Notified: April 08, 2008 Updated: April 08, 2008

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Lucent Technologies Unknown

Notified: December 13, 2007 Updated: December 13, 2007

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Luminous Networks Unknown

Notified: December 13, 2007 Updated: December 13, 2007

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Multinet (owned Process Software Corporation) Unknown

Notified: December 13, 2007 Updated: December 13, 2007

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Multitech, Inc. Unknown

Notified: December 13, 2007 Updated: December 13, 2007

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

NextHop Technologies, Inc. Unknown

Notified: December 13, 2007 Updated: December 13, 2007

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Nokia Unknown

Notified: April 08, 2008 Updated: April 08, 2008

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Nortel Networks, Inc. Unknown

Notified: December 13, 2007 Updated: December 13, 2007

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

OpenBSD Unknown

Notified: February 23, 2008 Updated: February 22, 2008

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Redback Networks, Inc. Unknown

Notified: December 13, 2007 Updated: December 13, 2007

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Riverstone Networks, Inc. Unknown

Notified: December 13, 2007 Updated: December 13, 2007

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Wind River Systems, Inc. Unknown

Notified: December 13, 2007 Updated: December 13, 2007

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

ZyXEL Unknown

Notified: December 13, 2007 Updated: December 13, 2007

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

View all 42 vendors __View less vendors __

CVSS Metrics

Group	Score	Vector
Base
Temporal
Environmental

References

• <http://tools.ietf.org/html/rfc4271&gt;
• <http://www.iana.org/assignments/bgp-parameters&gt;
• <http://tools.ietf.org/html/rfc2385&gt;
• <http://tools.ietf.org/html/rfc2439&gt;
• <http://secunia.com/advisories/28100/&gt;
• <http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-6372&gt;
• https://www.juniper.net/alerts/viewalert.jsp?actionBtn=Search&txtAlertNumber=PSN-2007-12-008&viewMod%20e=view
• <http://isc.sans.org/diary.php?storyid=3748&gt;
• <https://puck.nether.net/pipermail/juniper-nsp/2007-December/009294.html&gt;
• <https://puck.nether.net/pipermail/juniper-nsp/2007-December/009299.html&gt;
• <http://jvn.jp/cert/JVNVU929656/index.html&gt;
• <http://osvdb.org/show/osvdb/39157&gt;
• <http://www.securityfocus.com/bid/26869&gt;
• <http://www.frsirt.com/english/advisories/2007/4223&gt;
• <http://securitytracker.com/alerts/2007/Dec/1019100.html&gt;
• http://www.team-cymru.org/?sec=13&opt=28
• <http://secunia.com/advisories/30028/&gt;

Acknowledgements

Thanks to members of the Juniper Security Incident Response Team for help in preparing this document.

This document was written by Art Manion.

Other Information

CVE IDs:	CVE-2007-6372
Severity Metric:	24.49 Date Public: