[OPNFLWPLUG-361] [SECURITY] Topology spoofing via LLDP Created: 16/Feb/15 Updated: 27/Sep/21 Due: 16/Mar/15 Resolved: 03/Jun/15 |
|
| Status: | Resolved |
| Project: | OpenFlowPlugin |
| Component/s: | General |
| Affects Version/s: | None |
| Fix Version/s: | None |
| Type: | Bug | ||
| Reporter: | David Jorm | Assignee: | Jozef Gloncak |
| Resolution: | Done | Votes: | 0 |
| Labels: | None | ||
| Remaining Estimate: | Not Specified | ||
| Time Spent: | Not Specified | ||
| Original Estimate: | Not Specified | ||
| Environment: |
Operating System: All |
||
| Issue Links: |
|
||||||||
| External issue ID: | 2723 | ||||||||
| Description |
|
It has been reported that it is possible for an attacker to spoof network topology via LLDP. Details are in this paper: http://www.internetsociety.org/sites/default/files/10_4_2.pdf Two fixes are proposed: 1) Implement nonces for the LLDP messages, although this leaves a problem with MITM attacks where a host can copy LLDP from one point in the topology to other point. That would create a fake link between two OpenFlow switches. 2) Implement a mechanism that somehow warns administrator about unexpected topology changes. MITRE has been contacted requesting a CVE name for this issue. |
| Comments |
| Comment by Abhijit Kumbhare [ 16/Feb/15 ] |
|
Michal, Can you look into this? I will catch up with you over IRC sometime. There is also a security advisory on this: Thanks, |
| Comment by David Jorm [ 19/Feb/15 ] |
|
CVE-2015-1611 and CVE-2015-1612 have been assigned to this issue. On the TSC list it has been suggested that an SR3 release is shipped on 3/30. Would it be possible to include a fix for this issue in SR3? |
| Comment by Michal Rehak [ 16/Mar/15 ] |
| Comment by Anil Vishnoi [ 16/Mar/15 ] |
|
Above patch did not contain JUnit test, but we merged it because today is SR3 cut off date and we don't have enough time to add junit tests. Please keep this bug open till we include the junit tests. |
| Comment by Michal Rehak [ 16/Mar/15 ] |
|
merged |
| Comment by Michal Rehak [ 16/Mar/15 ] |
| Comment by David Jorm [ 17/Mar/15 ] |
|
I have updated the security advisories page to reflect the availability of a patch commit: https://wiki.opendaylight.org/view/Security_Advisories#.5BModerate.5D_CVE-2015-1611_CVE-2015-1612_openflowplugin:_topology_spoofing_via_LLDP Do we also need a patch for master to ensure this issue remains fixed in Lithium? |
| Comment by Michal Rehak [ 17/Mar/15 ] |
|
merged |
| Comment by Michal Rehak [ 17/Mar/15 ] |
|
(In reply to David Jorm from comment #7) Yes, |
| Comment by Jozef Gloncak [ 03/Jun/15 ] |
|
openflowplugin controller Merged on: stable/helium, master |