IEEE 802.1q Unauthorized VLAN Traversal Weakness
BID:615
Info
IEEE 802.1q Unauthorized VLAN Traversal Weakness
| Bugtraq ID: | 615 |
| Class: | Design Error |
| CVE: |
CVE-1999-1129 |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 02 1999 12:00AM |
| Updated: | Jul 11 2009 12:56AM |
| Credit: | This research and the resulting post was sent to the Bugtraq mailing list by Dave Taylor <[email protected]> & Steve Schuppp <[email protected]>. Further research was provided by "Andrew A. Vladimirov" <[email protected]>, Arhont Lt |
| Vulnerable: |
IEEE 802.1q Cisco IOS 11.2.8 SA5 Cisco Catalyst WS-C2924M-XL |
| Not Vulnerable: | |
Discussion
IEEE 802.1q Unauthorized VLAN Traversal Weakness
The 802.1q standard is susceptible to issues that allow attackers to send and receive packets from one VLAN to another without authorization.
By spoofing various Ethernet frame fields such as the source or destination MAC addresses, IP addresses, and VLAN tags, attackers may cause packets to traverse from one VLAN to another, and possibly back again. Attackers may also add multiple VLAN tags to packets to cause multiple routers to decapsulate the packets in unexpected ways, aiding the attacker in traversing VLANs.
This issue allows attackers to traverse from one VLAN to another in an unauthorized fashion. As some users may utilize VLANs to segregate network segments containing differing security properties, this may have various consequences.
This issue may be exacerbated by utilizing attacker-controlled external network hosts to bounce packets between VLANs.
The 802.1q standard is susceptible to issues that allow attackers to send and receive packets from one VLAN to another without authorization.
By spoofing various Ethernet frame fields such as the source or destination MAC addresses, IP addresses, and VLAN tags, attackers may cause packets to traverse from one VLAN to another, and possibly back again. Attackers may also add multiple VLAN tags to packets to cause multiple routers to decapsulate the packets in unexpected ways, aiding the attacker in traversing VLANs.
This issue allows attackers to traverse from one VLAN to another in an unauthorized fashion. As some users may utilize VLANs to segregate network segments containing differing security properties, this may have various consequences.
This issue may be exacerbated by utilizing attacker-controlled external network hosts to bounce packets between VLANs.
Exploit / POC
IEEE 802.1q Unauthorized VLAN Traversal Weakness
An exploit is not required.
An exploit is not required.
Solution / Fix
IEEE 802.1q Unauthorized VLAN Traversal Weakness
Solution:
Clayton Kossmeyer <[email protected]> of Cisco has responded to this issue as described by "Andrew A. Vladimirov" <[email protected]>. Various workarounds for Cisco products are detailed. Please see the referenced message for further information.
--
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Clayton Kossmeyer <[email protected]> of Cisco has responded to this issue as described by "Andrew A. Vladimirov" <[email protected]>. Various workarounds for Cisco products are detailed. Please see the referenced message for further information.
--
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
IEEE 802.1q Unauthorized VLAN Traversal Weakness
References:
References:
- Cisco Product Security Incident Response (Cisco Systems)
- Making unidirectional VLAN and PVLAN jumping bidirectional ("Andrew A. Vladimirov"
- Re: Making unidirectional VLAN and PVLAN jumping bidirectional (Clayton Kossmeyer