PT-2018-7259 · Rfc · Ospf

Adi Sosnovich + 2 · Publicado 2018-07-24 · Atualizado 2019-10-09 · CVE-2017-3224

Positive Technologies (AI Summary)

CVSS v3.1

8.2

Alta

Vetor base

AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Open Shortest Path First (OSPF) protocol implementations (affected versions not specified)

Description: The issue arises from improper determination of Link State Advertisement (LSA) recency for LSAs with MaxSequenceNumber. According to the protocol, when sequence numbers are the same, the LSA with the larger checksum is considered more recent. An attacker can craft a LSA with MaxSequenceNumber and invalid links, resulting in a larger checksum, which will not be flushed from the Link State Database (LSDB). This can lead to the erasure or alteration of routing tables, causing a denial of service condition or re-routing of traffic.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficient Verification of Data Authenticity

Enumeração de Fraquezas

CWE-345

CWE-354

Identificadores relacionados

CVE-2017-3224

Produtos afetados

Ospf

Referências · 6

• https://cve.org/CVERecord?id=CVE-2017-3224 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2017-3224 · Nota de Segurança
• http://kb.cert.org/vuls/id/793496 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-3224 · Aviso do Fabricante
• https://kb.cert.org/vuls/id/793496 · Nota
• https://ubuntu.com/security/CVE-2017-3224 · Aviso do Fabricante