Subject: [RPSEC] OSPF vulnerabilities draft

From: "Emanuele Jones" <[email-masked]>
Date: Fri, 11 Jul 2003 13:51:19 -0400

Greetings,

I would like to introduce a new Internet Draft: draft-jones-OSPF-vuln-00.txt. This draft is now available at the IETF website. 

I believe that even though the group has already moved to the developing of  a generic threat paper (draft-ietf-rpsec-routing-threats-01.txt), security of IGP has not been extensively covered and discussed as much as EGP's security was with BGP, SoBGP and SBGP. Thus, this paper may be a good occasion to initiate some work on that topic. This memo systematically dissects every message and every aspect of OSPF searching for vulnerabilities that could lead to insider, outsider or DoS attacks against the control and the data plane. The paper is more than just a literature survey about OSPF security; aside from discovering new vulnerabilities that came directly from the test bed, the draft highlights and describes a few "misconceptions" about OSPF's security such as "fight back" and remote attacker prevention.

The Internet Draft is available at: http://www.ietf.org/internet-drafts/draft-jones-ospf-vuln-00.txt

Regards,

Emanuele

Emanuele Jones 
Alcatel Canada - R&I - Security group 
600 March Road - Kanata, ON, Canada K2K 2E6 
Phone: +1 613 784 5977 Fax: +1 613 784 8944 
Email: [email-masked]