Subject: GTSM with OSPF

From: Pekka Savola <[email-masked]>
Date: Wed, 18 Aug 2004 23:12:42 +0300 (EEST)

>From today-published 
http://www.cisco.com/warp/public/707/cisco-sa-20040818-ospf.shtml:

"A Cisco device running Internetwork Operating System (IOS) and
enabled for the Open Shortest Path First (OSPF) protocol is vulnerable
to a Denial of Service (DoS) attack from a malformed OSPF packet. The
OSPF protocol is not enabled by default.

[...]

Since OSPF needs to process unicast packets as well as multicast
packets, this vulnerability can be exploited remotely. It is also
possible for an attacker to target multiple systems on the local
segment at a time."

Note: the most stringent check for unicast packets, unfortunately, is
to check that TTL=1 which is trivally spoofable..

This makes me wonder..

Do we need to specify anything to use GTSM with OSPF, or is it just a 
matter of implementation?

This would seem like a good idea to me.  Of course, folks will ask,
why not use OSPF authentication instead?  Maybe, maybe not.  It
consumes processing resources.  Key management is always an added
complexity.  It can be used as a DoS attack the same way as BGP MD5
authentication can.  It's not as simple as TTL-based authentication.

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings

_______________________________________________
routing-discussion mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/routing-discussion