Vulnerability CVE-2017-3224

Vulnerability Name:

CVE-2017-3224 (CCN-129544)

Assigned:

2016-12-05

Published:

2017-07-27

Updated:

2019-10-09

Summary:

Open Shortest Path First (OSPF) protocol implementations may improperly determine Link State Advertisement (LSA) recency for LSAs with MaxSequenceNumber. According to RFC 2328 section 13.1, for two instances of the same LSA, recency is determined by first comparing sequence numbers, then checksums, and finally MaxAge. In a case where the sequence numbers are the same, the LSA with the larger checksum is considered more recent, and will not be flushed from the Link State Database (LSDB). Since the RFC does not explicitly state that the values of links carried by a LSA must be the same when prematurely aging a self-originating LSA with MaxSequenceNumber, it is possible in vulnerable OSPF implementations for an attacker to craft a LSA with MaxSequenceNumber and invalid links that will result in a larger checksum and thus a 'newer' LSA that will not be flushed from the LSDB. Propagation of the crafted LSA can result in the erasure or alteration of the routing tables of routers within the routing domain, creating a denial of service condition or the re-routing of traffic on the network. CVE-2017-3224 has been reserved for Quagga and downstream implementations (SUSE, openSUSE, and Red Hat packages).

CVSS v3 Severity:

8.2 High (CVSS v3.1 Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:H)
7.2 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:H/E:U/RL:U/RC:R)

Exploitability Metrics:	Attack Vector (AV): Adjacent Attack Complexity (AC): High Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Changed
Impact Metrics:	Confidentiality (C): Low Integrity (I): High Availibility (A): High

6.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
5.6 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:U/RC:R)

Exploitability Metrics:	Attack Vector (AV): Adjacent Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): Low

CVSS v2 Severity:

4.3 Medium (CVSS v2 Vector: AV:A/AC:M/Au:N/C:N/I:P/A:P)

Exploitability Metrics:	Access Vector (AV): Adjacent_Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): Partial

5.8 Medium (CCN CVSS v2 Vector: AV:A/AC:L/Au:N/C:P/I:P/A:P)

Exploitability Metrics:	Access Vector (AV): Adjacent_Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

Vulnerability Type:

CWE-345

Vulnerability Consequences:

Bypass Security

References:

Source: MITRE
Type: CNA
CVE-2017-3224

Source: CCN
Type: US-CERT VU#793496
Open Shortest Path First (OSPF) protocol implementations may improperly determine LSA recency

Source: CCN
Type: Quagga Web site
Quagga

Source: XF
Type: UNKNOWN
quagga-cve20173224-sec-bypass(129544)

Source: CERT-VN
Type: Third Party Advisory, US Government Resource
VU#793496

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2017-3224

Vulnerable Configuration:

Configuration 1:

cpe:/a:quagga:quagga:-:*:*:*:*:*:*:*

Configuration 2:

cpe:/o:suse:opensuse:-:*:*:*:*:*:*:*

OR cpe:/o:suse:suse_linux:-:*:*:*:*:*:*:*

Configuration 3:

cpe:/a:redhat:package_manager:-:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:quagga:quagga:-:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:com.ubuntu.xenial:def:201732240000000	V	CVE-2017-3224 on Ubuntu 16.04 LTS (xenial) - low.	2018-07-24
oval:com.ubuntu.xenial:def:20173224000	V	CVE-2017-3224 on Ubuntu 16.04 LTS (xenial) - low.	2018-07-24
oval:com.ubuntu.disco:def:201732240000000	V	CVE-2017-3224 on Ubuntu 19.04 (disco) - low.	2018-07-24
oval:com.ubuntu.bionic:def:20173224000	V	CVE-2017-3224 on Ubuntu 18.04 LTS (bionic) - low.	2018-07-24
oval:com.ubuntu.cosmic:def:201732240000000	V	CVE-2017-3224 on Ubuntu 18.10 (cosmic) - low.	2018-07-24
oval:com.ubuntu.cosmic:def:20173224000	V	CVE-2017-3224 on Ubuntu 18.10 (cosmic) - low.	2018-07-24
oval:com.ubuntu.bionic:def:201732240000000	V	CVE-2017-3224 on Ubuntu 18.04 LTS (bionic) - low.	2018-07-24
oval:com.ubuntu.trusty:def:20173224000	V	CVE-2017-3224 on Ubuntu 14.04 LTS (trusty) - low.	2018-07-24
oval:com.ubuntu.artful:def:20173224000	V	CVE-2017-3224 on Ubuntu 17.10 (artful) - low.	2017-07-28

BACK