Multiple Vendor IRDP Vulnerability
BID:578
Info
Multiple Vendor IRDP Vulnerability
| Bugtraq ID: | 578 |
| Class: | Origin Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 11 1999 12:00AM |
| Updated: | Aug 11 1999 12:00AM |
| Credit: | This vulnerability was discovered by L0pth Heavy Industries (LHI). It's public release was August 11, 1999. |
| Vulnerable: |
Sun Solaris 2.6_x86 Sun Solaris 2.6 Microsoft Windows 98SE Microsoft Windows 98 b Microsoft Windows 98 a |
| Not Vulnerable: | |
Discussion
Multiple Vendor IRDP Vulnerability
[This discussion is verbatim from the LHI Advisory referenced in the "Reference Section" of this vulnerability entry with very few changes]
The ICMP Router Discovery Protocol (IRDP) comes enabled by default on DHCP clients that are running Microsoft Windows95 (w/winsock2), Windows95b, Windows98, Windows98se, and Windows2000 machines. By spoofing IRDP Router Advertisements, an attacker can remotely add default route entries on a remote system. The default route entry added by the attacker will be preferred over the default route obtained from the DHCP server. This results in higher susceptibility to denial of service, passive snooping and man in the middle attacks. While Windows 2000 does indeed have IRDP enabled by default, it is less vulnerable as it is impossible to give it a route that is preferred over the default route obtained via DHCP.
SunOS systems will also intentionally use IRDP under specific conditions. For Solaris2.6, the IRDP daemon, in.rdisc, will be started if the following conditions are met:
The system is a host, not a router.
The system did not learn a default gateway from a DHCP server.
The system does not have any static routes.
The system does not have a valid /etc/defaultrouter file.
[This discussion is verbatim from the LHI Advisory referenced in the "Reference Section" of this vulnerability entry with very few changes]
The ICMP Router Discovery Protocol (IRDP) comes enabled by default on DHCP clients that are running Microsoft Windows95 (w/winsock2), Windows95b, Windows98, Windows98se, and Windows2000 machines. By spoofing IRDP Router Advertisements, an attacker can remotely add default route entries on a remote system. The default route entry added by the attacker will be preferred over the default route obtained from the DHCP server. This results in higher susceptibility to denial of service, passive snooping and man in the middle attacks. While Windows 2000 does indeed have IRDP enabled by default, it is less vulnerable as it is impossible to give it a route that is preferred over the default route obtained via DHCP.
SunOS systems will also intentionally use IRDP under specific conditions. For Solaris2.6, the IRDP daemon, in.rdisc, will be started if the following conditions are met:
The system is a host, not a router.
The system did not learn a default gateway from a DHCP server.
The system does not have any static routes.
The system does not have a valid /etc/defaultrouter file.
Exploit / POC
Multiple Vendor IRDP Vulnerability
L0pht (LHI) has made available Proof-of-Concept code that will let individuals test their systems & firewalls.
Usage is as follows:
Usage: rdp -v -l -s -d <delay> -p <pref> -t <lifetime> -i <dev>
-S <src> -D <dst> -R <rtr> -r <optional 2nd rtr>
-v verbose
-l listen mode
-s send mode
-d <delay time between sending packets>
-n <number of rdp packets to send>
-I <ID value to place in IP packet>
-p <preference level>
-t <lifetime>
-i <interface to use for sniffing>
-S <source address to put in outgoing rdp packet>
-D <destination address to put in outgoing rdp packet>
-R <router address to advertise in rdp packet>
-r <optional 2nd router address to advertise in rdp packet>
Misc software notes:
Listen Mode: Software listens for ICMP Router Solicitations. If the '-s' flag is specified as well, the software will answer the Solicitations with ICMP Router Advertisements.
Preference: If the preference is not specified, it will use a default of 1000, which will give the default route a metric of 0 on affected Windows systems.
2nd Router Addr: By using the '-r' flag and specifying a second router address entry, the packet can contain a bogus source address and still be processed for correct gateway entries by the end host.
L0pht (LHI) has made available Proof-of-Concept code that will let individuals test their systems & firewalls.
Usage is as follows:
Usage: rdp -v -l -s -d <delay> -p <pref> -t <lifetime> -i <dev>
-S <src> -D <dst> -R <rtr> -r <optional 2nd rtr>
-v verbose
-l listen mode
-s send mode
-d <delay time between sending packets>
-n <number of rdp packets to send>
-I <ID value to place in IP packet>
-p <preference level>
-t <lifetime>
-i <interface to use for sniffing>
-S <source address to put in outgoing rdp packet>
-D <destination address to put in outgoing rdp packet>
-R <router address to advertise in rdp packet>
-r <optional 2nd router address to advertise in rdp packet>
Misc software notes:
Listen Mode: Software listens for ICMP Router Solicitations. If the '-s' flag is specified as well, the software will answer the Solicitations with ICMP Router Advertisements.
Preference: If the preference is not specified, it will use a default of 1000, which will give the default route a metric of 0 on affected Windows systems.
2nd Router Addr: By using the '-r' flag and specifying a second router address entry, the packet can contain a bogus source address and still be processed for correct gateway entries by the end host.
Solution / Fix
Multiple Vendor IRDP Vulnerability
Solution:
Windows95/98:
The Microsoft Knowledge Base contains an article that gives info on how to disable IRDP. It can be found at:
http://support.microsoft.com/support/kb/articles/q216/1/41.asp
Solaris:
Configure your host to obtain a default gateway through DHCP, static routes, or via the /etc/defaultrouter file. For more information on IRDP refer to in.rdisc's man-page.
Firewalls:
Block all ICMP Type 9 & Type 10 packets. This should protect against remote Denial of Service attacks.
Solution:
Windows95/98:
The Microsoft Knowledge Base contains an article that gives info on how to disable IRDP. It can be found at:
http://support.microsoft.com/support/kb/articles/q216/1/41.asp
Solaris:
Configure your host to obtain a default gateway through DHCP, static routes, or via the /etc/defaultrouter file. For more information on IRDP refer to in.rdisc's man-page.
Firewalls:
Block all ICMP Type 9 & Type 10 packets. This should protect against remote Denial of Service attacks.
References
Multiple Vendor IRDP Vulnerability
References:
References:
- L0pht Heavy Industries Advisories (L0pht Heavy Industries)
- NFR Intrusion Detection Module (L0pht Heavy Industries)
- Q216141: Disable IRDP Automatically Using WSH VBScript (Microsoft)
- Sun Patch Access Page (Sun Microsystems)
- Sunsolve Online(tm) (Sun Microsystems)