Bugtraq mailing list archives

Re: [Full-disclosure] HP A-series switches are affected, too. [WAS: More on IPv6 RA-Guard evasion (IPv6 security)]

From: Dan Luedtke <maildanrl () googlemail com>
Date: Thu, 1 Sep 2011 12:44:57 +0200

Hello Fernando,

On Thu, Sep 1, 2011 at 12:10 PM, Fernando Gont <fgont () si6networks com> wrote:

Based on Marc's ideas I tested the mentioned attack on Hewlett
Packard's A-series switches, and I have to say that these attacks were
successful. That stopped us from implementing IPv6 for a while in our
network.


Do they ship with "RA-Guard"? -- Note that "hosts being vulnerable to
RA-based attacks" does not imply a vulnerable RA-Guard implementation.
The layer-2 might simply not ship with RA-Guard, it could ship with it
but not be enabled, etc.

I have to admit, I was a little bit sloppy about the term RA-Guard.
Every vendors has another name for the feature that *should* provide
protection from faked Router Advertisements, technically it is
sometimes like RA-Guard, in reality it is often a simple ACL wrapped
in a shiny new command. HP tried to implement it in their "Neighbor
Discovery Detection" feature of Comware, and they succeeded partly.
One has to craft some nasty packets to circumvent their protection,
but one still is able to do so.

Anyway... I'd bet that every implementation that "followed" the spec is
vulnerable....

Unfortunately :(

By the way, I don't think it is a good idea to disallow any Extension
Headers in ND-Messages,


Consensus at the relevant IETF working-group (6man) seems to be to only
ban the Fragment Header (when SEND is not employed).

I'd like to discuss this further, there are many options and I really
like to read other's opinions on that. Disallowing Fragmentation
Headers might break some stack implementations (but hopefully only in
some situations). On the other hand, (virtually) reassembling IPv6
packets on a layer2 device is expensive.

I'll have a look on ipv6-hackers as soon as I am back from vacation.

Yep... will post something right now, and see if that triggers discussion.

Thanks!

regards,
   danrl
-- 
danrl / Dan Luedtke
http://www.danrl.de

Current thread:

Re: [Full-disclosure] HP A-series switches are affected, too. [WAS: More on IPv6 RA-Guard evasion (IPv6 security)] Dan Luedtke (Sep 01)
- <Possible follow-ups>
- Re: [Full-disclosure] HP A-series switches are affected, too. [WAS: More on IPv6 RA-Guard evasion (IPv6 security)] Fernando Gont (Sep 01)
  - Re: [Full-disclosure] HP A-series switches are affected, too. [WAS: More on IPv6 RA-Guard evasion (IPv6 security)] Dan Luedtke (Sep 01)
  - Re: [Full-disclosure] HP A-series switches are affected, too. [WAS: More on IPv6 RA-Guard evasion (IPv6 security)] Marc Heuse (Sep 01)
    - Re: [Full-disclosure] HP A-series switches are affected, too. [WAS: More on IPv6 RA-Guard evasion (IPv6 security)] Fernando Gont (Sep 01)