- Test - lists.nanog.org

Cisco IOS EIGRP Network DoS
by James-lists 20 Dec '02

20 Dec '02

----- Original Message ----- From: "FX" <fx(a)phenoelit.de> To: <bugtraq(a)securityfocus.com>; <darklab(a)darklab.org> Sent: Thursday, December 19, 2002 10:06 AM Subject: Cisco IOS EIGRP Network DoS Hi there, please find attached an advisory about an issue with the Cisco IOS Enhanced IGRP implementation that can be used to cause a network segment wide denial of service condition. Regards FX -- FX <fx(a)phenoelit.de> Phenoelit (http://www.phenoelit.de) 672D 64B2 DE42 FCF7 8A5E E43B C0C1 A242 6D63 B564 Attached text moved here: Phenoelit Advisory <wir-haben-auch-mal-was-gefunden #0815 +++-> [ Title ] Cisco Systems IOS EIGRP Network Denial of Service [ Authors ] FX <fx(a)phenoelit.de> Phenoelit Group (http://www.phenoelit.de) Advisory http://www.phenoelit.de/stuff/CiscoEIGRP.txt [ Affected Products ] Cisco IOS Tested on: IOS 11.3 IOS 12.0(19) IOS 12.2 Cisco Bug ID: <not assigned> CERT Vu ID: <not assinged> [ Vendor communication ] 10/08/02 Initial Notification, gaus(a)cisco.com 10/08/02 - 11/14/02 Communication with gaus(a)cisco.com about the issue, fixes and timelines. 12/18/02 Final advisory going public as coordinated release *Note-Initial notification by phenoelit includes a cc to cert(a)cert.org by default [ Overview ] Cisco Systems IOS is vulnerable to a denial-of-service attack using Cisco's proprietary routing protocol Enhanced IGRP (EIGRP). When flooding a Cisco router with spoofed EIGRP neighbor announcements, the router will cause an Address Resultion Protocol (ARP) storm on the network segment while trying to find the MAC addresses for the newly discovered neighbors, effectively using all available bandwidth. [ Description ] EIGRP uses automatic discovery of neighboring routers. An EIGRP router announces it's existence via multicast on the enabled interfaces. If two routers discover each other, they try to exchange information about the current topology in unicast. On Ethernet, both sides need to obtain the MAC address of the other router. When generating EIGRP neighbor announcements with random source IP addresses and flooding a Cisco router (unicast, only possible in 11.x) or an entire network (multicast), all receiving Cisco routers will try to contact the sender(s). The source IP addresses have to be in the subnet(s) enabled via the "network" statement in the config of the victim router. A bug in Cisco IOS causes the router to continiously try to obtain the MAC address of the sender. This process does not time out unless the EIGRP neighbor holdtimer expires. This value is supplied by the sender of the neighbor announcement and has a maximum of over 18 hours. Multiple neighbor announcements with not existing source IP addresses will cause the router to use all available CPU power and bandwidth on the segment for ARP request - creating a segment-wide denial of service condition. The possible use of IP multicast poses a high risk for larger corporate networks using EIGRP. Cisco IOS versions below 12.0 also accept EIGRP neighbor announcements as unicast packets, which makes the attack possible via the Internet. [ Example ] None provided at this time. [ Solution ] Implement EIGRP authentication using MD5 hashes - which should have been done in the first place. Where MD5 can not be implemented, use extended access lists to match expected neighbors. The obvious workaround of using fixed neighbor entries in the configuration does not work due to another bug in IOS that makes it ignore the command (Cisco Bug ID CSCdv19648). [ end of file ($Revision: 1.5 $) ] Cisco comments on Bug traq: -----BEGIN PGP SIGNED MESSAGE----- We can confirm the statement made by FX from Phenoelit in his message "Cisco IOS EIGRP Network DoS" posted on 2002-Dec-19. The EIGRP implementation in all versions of IOS is vulnerable to a denial of service if it receives a flood of neighbor announcements. EIGRP is a Ciscos' extension of IGP routing protocol used to propagate routing information in internal network environments. The workaround for this issue is to apply MD5 authentication that will permit the receipt of EIGRP packets only from authorized hosts. You can find an example of how to configure MD5 authentication for EIGRP at the following URL (possibly wrapped): http://www.cisco.com/univercd/cc/td/doc/product/software/ios120/12cgcr/ np1_c/1cprt1/1ceigrp.htm#xtocid18 If you are using EIGRP in the unicast mode then you can mitigate this issue by placing appropriate ACL which will block all EIGRP packets from illegitimate hosts. In the following example the EIGRP neighbor has IP address of 10.0.0.2 and the local router has address 10.0.0.1. Router#config t Router(config)#access-list 111 permit eigrp host 10.0.0.2 host 10.0.0.1 Router(config)#access-list 111 deny eigrp any host 10.0.0.1 The previous example will permit all EIGRP packet throughout the router and into the rest of the network. If you want to block these packets as well then use the following commands instead of the previous example: Router#config t Router(config)#access-list 111 permit eigrp host 10.0.0.2 host 10.0.0.1 Router(config)#access-list 111 deny eigrp any any An ACL will not be effective if you are using the default multicast mode of EIGRP neighbor discovery. However, multicast packets should not be propagated through the Internet so an attacker must be on the same local network segment as the target router in order to exploit this issue with multicast advertisements. The issue with EIGRP neighbor command FX is referring to is assigned Cisco Bug ID CSCdv19648 and is visible to all registered users through Cisco's Bug Toolkit at http://www.cisco.com/cgi-bin/Support/Bugtool/launch_bugtool.pl. At the time of writing this notice Cisco PSIRT does not have a current estimate on when the fix will be available. Gaus -----BEGIN PGP SIGNATURE----- Version: PGP 6.5.3 iQEVAwUBPgIFTw/VLJ+budTTAQE7yggAiDxmo8MFD9rULZAG1PKcnn0wfHungE1a dMfLN1oUaW7LYaMv+PJYkCvSO4t8oJlmQE9MXV3Q9VgLu9FHQDul3tzpOXMCmRB9 19H0XThGXzj7hDUbOrqgYXgDKQucarXg6yZ0nIuxNhEkl4XsnDohaMIkH7ynV/mY mQ2qIehPw6aus2plvGDKDYZVTbClHk1qjTWhL3AgFqbVH9zkOHppLF47kP/adRlh GeloUfxwMAJP2w4/MXObHMr9ELY+8mku/Fi0IBMfnZtS/VprZQZuvYQQmov7uYMV VkvCoI/mkjkJGlTZyxHGtIbQGelC/eub+r4SiCxtH6APiFWaYWnwVw== =o5+g -----END PGP SIGNATURE----- ============== Damir Rajnovic <psirt(a)cisco.com>, PSIRT Incident Manager, Cisco Systems <http://www.cisco.com/go/psirt> Telephone: +44 7715 546 033 200 Longwater Avenue, Green Park, Reading, Berkshire RG2 6GB, GB ============== There is no insolvable problems. The question is can you accept the solution?

2 1

Using link congestion to control routing updates
by David Scott Olverson 19 Dec '02

19 Dec '02

Hello all, I was wondering if anyone was aware of a way to use the congestion of a network link to control the routing update. For example if I have a very small link that gets congested, I may want the router to withhold a routing update until link congestion falls below a certain threshold like 60% of bandwidth. Is anyone aware of anything like this available today or a technique that might accomplish something similar? You can contact me off list if this topic isn't germane. Thanks for your help, Dave Olverson

3 2

Re: Cogent Thrashing Box: results
by Mike (meuon) Harrison 19 Dec '02

19 Dec '02

On Thu, 19 Dec 2002, ______________ wrote: > On Thu, 19 Dec 2002, Mike (meuon) Harrison wrote: > > > In the middle of all of this talk re: Cogent and such, > > they apparantly spent some $$$ somewhere and made our > > test connection a whole lot better. > > This is "better"? > > 3 so-1-0-0.mp2.NewYork1.Level3.net (212.187.128.153) 73.894 ms 73.798 ms 73.850 ms > 4 gigabitethernet5-2.core1.NewYork1.Level3.net (64.159.17.165) 74.199 ms 75.522 ms 74.397 ms > 5 204.6.134.162 (204.6.134.162) 962.177 ms 959.560 ms 960.519 ms > 6 p5-0.br01.jfk01.atlas.psi.net (154.54.1.197) 3806.177 ms 3814.665 ms 3836.955 ms > 7 p14-0.core01.jfk01.atlas.cogentco.com (154.54.1.21) 3830.980 ms 3813.222 ms 3811.389 ms > 8 p13-0.core02.jfk02.atlas.cogentco.com (66.28.4.121) 3770.229 ms 3815.093 ms 3839.036 ms > 9 p14-0.core01.phl01.atlas.cogentco.com (66.28.4.2) 3814.309 ms 3823.906 ms 3846.192 ms > 10 g0-2.na21.b003003-3.phl01.atlas.cogentco.com (66.250.13.190) 3847.378 ms 3833.999 ms 3817.632 ms > 11 Covista.demarc.cogentco.com (66.28.30.50) 3778.689 ms 3782.988 ms 3820.756 ms > 12 66.18.32.130 (66.18.32.130) 3832.508 ms 3835.835 ms 3851.331 ms > 13 66.28.38.150 (66.28.38.150) 3856.752 ms 3853.476 ms 3856.500 ms It has sure failed under load today. Killing it.. 'Nuff said. Lots of similiar traces on the MTR (matts traceroute) from the system as well. the resulting tests from today are crudely presented at: http://speedy.higherbandwidth.net/resultsall.cgi Click on the IP address to see the trace.. An amazing link is: http://speedy.higherbandwidth.net/results2.cgi?ip=209.244.4.106 Sure.. the web test is not perfect.. but that is a LOT of variety in results. Like this one: http://speedy.higherbandwidth.net/results2.cgi?ip=12.170.34.5 Thanks folks..

1 0

Anyone seeing issue with ATT this morning?
by Flint Barber 19 Dec '02

19 Dec '02

Hearing a lot of complaints this morning from ATT Cable subscribers.. anyone have an info?? -flint

1 0

RE: UseNet Feeds...(OT?)
by Ringdahl, Dwight (WebUseNet) 19 Dec '02

19 Dec '02

I don't really think that a free peering session seems like a 'sales job' and I don't agree that the original use/protocol of the internet would be off topic. As for Satellite feeds... Show me a feed provider who's satellite pushes more than 45mb/s which is now only 60% of a full feed. Yesterday a full feed from our system would have filled up 1.046TB of disk space, a whole lot more than 200gB. This is a growing issue on most networks, at 73mb/s just for the feed not including any reading traffic. One of our customers receives over 800mb/s 24/7 just in NNTP reader traffic... And that's not the largest I have heard of out there. I think Verizon and RR are 2 of the larger one.

2 1

UseNet Feeds.
by Ringdahl, Dwight (WebUseNet) 19 Dec '02

19 Dec '02

If anyone has a usenet server and would like a feed let me know. (FYI current full feed is 72mb/s) We also can peer bandwidth at any of our sites which you can see at http://www.webusenet.com/peering.html (PAIX ATL and Palo Alto are too) Thanks Dwight

2 1

Cogent Thrashing Box Available. IPERF and Web
by Mike (meuon) Harrison 19 Dec '02

19 Dec '02

On Thu, 19 Dec 2002, ______ _________ wrote: > Ehh...something isn't quite right... I managed '573 kBytes/sec' on a > 1.5/384 consumer ADSL... 573 kBytes/sec is > 1.5mbit by a good margin :) > Though it is a nice ego boost LOL :) Running the test again as I'm typing > this message so we'll see what it gets me (hopefully more realistic). I do > have path MTU on as well as large TCP windows which might be affecting the > numbers some but I can't be sure...Second test yielded even wierder > results...Locally another machine started a download so the results > should've been much lower, instead my result was like 3272.73 this time, > even less possible... :D I took out the name, as it was sent to me privately. We saw this last time testing with them as well. Speed tests on this box locally on 100mbps ethernet show normal realistic settings. What we are theorizing is that Cogent is caching outgoing/incoming web traffic, the web server sees the buffered speed.. and reports it.

1 0

Cogent and Level3 Peering Issues
by Dale Levesque 19 Dec '02

19 Dec '02

Anyone happen to have more information on the problems that have been happening with the peering between Cogent and Level3. Cogent gives the standard answer when you call support, but some more specific information would be great. Thanks Dale

10 19

(no subject)
by Ringdahl, Dwight (WebUseNet) 19 Dec '02

19 Dec '02

>> Thing is if your connection is completely full one way, it'll effect >> traffic the other way too. My thoughts are Cogents primary customers are sites that are looking for very cheap bandwidth, which most likely is adult content. Therefore they would look more like a content provider than a transit provider. My question, being a content network, is how would AOL expect them to have a balanced pipe? AOL is all eyeballs, and really doesn't have much content which is useful outside of their user base. Especially if you already peer with Time Warner in other sites. When ISP's peer I would have thought it is to prevent having to pay transit companies like Level3 for the bandwidth. This leads me to believe there might be something more to this, like maybe the spam spewed from the adult sites. Just a guess, anyone have any hard data? Dwight

5 4

Semi off-topic - DC power plant contractors
by Brian Wallingford 19 Dec '02

19 Dec '02

Looking for an electrical contractor in the northeast (preferably in the Providence/Boston area) capable of placing an existing Lorain rectifier & battery array in service. All work must comply to local (Providence) code. Job will include running cabling from the plant to Telect 60A dist panels. Off-list feedback is most welcome. cheers, brian

2 1