Input validation

🗓️ 09 Sep 2021 14:15:00Reported by PRIOn knowledge baseType

Any CA issuer in the RPKI can trick OctoRPKI prior to 1.3.0 into emitting an invalid VRP "MaxLength" value, causing RTR sessions to terminate. An attacker can use this to disable RPKI Origin Validation in a victim network (for example AS 13335 - Cloudflare) prior to launching a BGP hijack which during normal operations would be rejected as "RPKI invalid". Additionally, in certain deployments RTR session flapping in and of itself also could cause BGP routing churn, causing availability issues

Reporter	Title	Published	Views	Family All 24
Circl	CVE-2021-3761	9 Sep 202118:29	–	circl
CNNVD	RPKI 缓冲区错误漏洞	9 Sep 202100:00	–	cnnvd
CVE	CVE-2021-3761	9 Sep 202114:05	–	cve
Cvelist	CVE-2021-3761 OctoRPKI lacks contextual out-of-bounds check when validating RPKI ROA maxLength values	9 Sep 202114:05	–	cvelist
Debian	[SECURITY] [DSA 5041-1] cfrpki security update	11 Jan 202221:54	–	debian
Debian CVE	CVE-2021-3761	9 Sep 202114:05	–	debiancve
Tenable Nessus	Debian DSA-5041-1 : cfrpki - security update	12 Jan 202200:00	–	nessus
EUVD	EUVD-2021-2036	7 Oct 202500:30	–	euvd
Github Security Blog	OctoRPKI lacks contextual out-of-bounds check when validating RPKI ROA maxLength values	7 Sep 202123:02	–	github
NVD	CVE-2021-3761	9 Sep 202114:15	–	nvd