ENSRT Advisory Note ETS-i-2004-11036

The Enterasys Networks Security Response Team (ENSRT) publishes incident notes to provide information for our constituents to raise awareness of issues deemed threatening to the security and integrity of our customers.

Record route option can cause a reboot on the XSR platform

Release Date: 7/6/2004
Last Updated: 7/6/2004

Overview

SecurityTracker Alert ID: 1010641
Record route option can cause a reboot on the XSR platform

Products effected:

XSR18xx/3xxx

Description

A vulnerability was reported in the Enterasys XSR Security Router XSR-1800 series. It was reported that a remote user can cause denial of service conditions using the record route option in the hping tool. After careful study of the commands used and the configuration of the router in question, it was determined that the issue is particular to the user’s configuration and specifically the use of Policy-Based Routing. This issue is believed to exist in the XSR 3000 as well.

Policy-Based Routing (PBR) is a method used on the XSR platform to configure specific routes based on ACLs. PBR is typically used for a particular server or workstation on an internal network to route a specific type of traffic through a redundant path that is not necessarily the path of least cost reported by the routing protocol used on that router.

The record route option provides a means to record the route of an Internet datagram. When a router routes a datagram it checks to see if the record route option is present. If it is, it inserts its own internet address as known in the environment into which this datagram is being forwarded into the recorded route beginning at the byte indicated by the pointer, and increments the pointer by four.

REMEDIATION

N7
E7
E6
E5
E1
C1
VH
V
XP
XSR
IDS
Netsight
Wireless
-
-
-
-
-
-
-
-
-
X
-
-
-

Detection:
not applicable

Prevention:
not applicable

Containment:
no applicable

Repair:
Disable Policy-Based Routing

Enterasys currently expects a patch for this issue to be available by 7/13/2004 based on 7.0 version of firmware

Reporting

ENSRT is tracking activity related to this vulnerability as ETS-v-2004-11036. Relevant artifacts or activity can be sent to enet-ensrt@enterasys.com with the appropriate INCIDENT# in the subject line.

References

http://www.securitytracker.com/alerts/2004/Jul/1010641.html

This document and the information contained herein are intended solely for informational use. Enterasys Networks, Inc. makes no representations or warranties of any kind, whether expressed or implied, with respect to this information and assumes no responsibility for its accuracy or completeness. Enterasys Networks, Inc. hereby disclaims all liability and warranty for any information contained herein and all the material and information herein exists to be used only on an "as is" basis. More specific information may be available on request. By your review and/or use of the information contained herein, you expressly release Enterasys from any and all liability related in any way to this information.

A copy of the text of this section is an uncontrolled copy, and may lack important information or contain factual errors. All information herein is Copyright © Enterasys Networks, Inc. All rights reserved. All information above is subject to change without notice.

Revision History:

Version	Date	Author	Change
1.0	7/6/2004	ENSRT Staff	Original