S-262: Cisco IOS Multicast Virtual Private Network (MVPN) Data Leak


 
Thread Tools Search this Thread
Special Forums Cybersecurity Security Advisories (RSS) S-262: Cisco IOS Multicast Virtual Private Network (MVPN) Data Leak
# 1  
Old 04-10-2008
S-262: Cisco IOS Multicast Virtual Private Network (MVPN) Data Leak

A vulnerability in the Cisco implementation of Multicast Virtual Private Network (MVPN) is subject to exploitation that can allow a malicious user to create extra multicast states on the core routers or receive multicast traffic from other Multiprotocol Label Switching (MPLS) based Virtual Private Networks (VPN) by sending specially crafted messages. The risk is LOW. Successful exploitation of the vulnerability can result in the creation of extra multicast states on the core routers or the leaking of multicast traffic from one MPLS VPN to another.


More...
Login or Register to Ask a Question

Previous Thread | Next Thread

4 More Discussions You Might Find Interesting

1. Solaris

Cisco IOS VPN server IKE

How do I tell if Cisco IOS VPN server IKE is running on my solaris 10 system (1 Reply)
Discussion started by: pgsanders
1 Replies

2. Shell Programming and Scripting

Need help on ssh login script to cisco ios

I'm trying to write a login script to ssh into a cisco switch that will run some command remotely. Similar to this expect script located here: SSH login expect shell script to supply username and password However, that script does not work with cisco ios. Anyway know what the best way to... (1 Reply)
Discussion started by: streetfighter2
1 Replies

3. Linux

How to multicast on different IP network

On Linux, I have configured two different IP address for two network device eth0 ,eth1 , in my program, I want to multicast differently on these two network, I know it must add route for single network and I try to config another route for second network,but it can not work correctly, how to config... (0 Replies)
Discussion started by: Frank2004
0 Replies

4. IP Networking

private network to private network gateway

i have one private network with one ip address, and i have a seperate network on a seperate ip address. now, each network is behind a firewall/router. now what i want to do is be able to access one server on the second network from a computer on the first., but with the private ip address, (this... (2 Replies)
Discussion started by: norsk hedensk
2 Replies
Login or Register to Ask a Question
RDISC(8)						 System Manager's Manual: iputils						  RDISC(8)

NAME
rdisc - network router discovery daemon SYNOPSIS
rdisc [ -abdfstvV] [ send_address] [ receive_address] DESCRIPTION
rdisc implements client side of the ICMP router discover protocol. rdisc is invoked at boot time to populate the network routing tables with default routes. rdisc listens on the ALL_HOSTS (224.0.0.1) multicast address (or receive_address provided it is given) for ROUTER_ADVERTISE messages from routers. The received messages are handled by first ignoring those listed router addresses with which the host does not share a network. Among the remaining addresses the ones with the highest preference are selected as default routers and a default route is entered in the kernel routing table for each one of them. Optionally, rdisc can avoid waiting for routers to announce themselves by sending out a few ROUTER_SOLICITATION messages to the ALL_ROUTERS (224.0.0.2) multicast address (or send_address provided it is given) when it is started. A timer is associated with each router address and the address will no longer be considered for inclusion in the the routing tables if the timer expires before a new advertise message is received from the router. The address will also be excluded from consideration if the host receives an advertise message with the preference being maximally negative. Server side of router discovery protocol is supported by Cisco IOS and by any more or less complete UNIX routing daemon, f.e gated. OPTIONS
-a Accept all routers independently of the preference they have in their advertise messages. Normally rdisc only accepts (and enters in the kernel routing tables) the router or routers with the highest preference. -b Opposite to -a, i.e. install only router with the best preference value. It is default behaviour. -d Send debugging messages to syslog. -f Run rdisc forever even if no routers are found. Normally rdisc gives up if it has not received any advertise message after after soliciting three times, in which case it exits with a non-zero exit code. If -f is not specified in the first form then -s must be specified. -s Send three solicitation messages initially to quickly discover the routers when the system is booted. When -s is specified rdisc exits with a non-zero exit code if it can not find any routers. This can be overridden with the -f option. -t Test mode. Do not go to background. -v Be verbose i.e. send lots of debugging messages to syslog. -V Print version and exit. HISTORY
This program was developed by Sun Microsystems (see copyright notice in source file). It was ported to Linux by Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>. SEE ALSO
icmp(7), inet(7), ping(8). REFERENCES
Deering, S.E.,ed "ICMP Router Discovery Messages", RFC1256, Network Information Center, SRI International, Menlo Park, Calif., September 1991. SECURITY
rdisc requires CAP_NET_RAWIO to listen and send ICMP messages and capability CAP_NET_ADMIN to update routing tables. AVAILABILITY
rdisc is part of iputils package and the latest versions are available in source form for anonymous ftp ftp://ftp.inr.ac.ru/ip-rout- ing/iputils-current.tar.gz. iputils-021109 09 iINAON 2002 RDISC(8)