Beyond Security Blog
laptop and network monitoring icons on blue gradient vector

IP Encapsulation Authentication Bypass by Spoofing Vulnerability

Summary

IP-in-IP encapsulation is a tunneling protocol specified in RFC 2003 that allows for IP packets to be encapsulated inside another IP packets. This is very similar to IPSEC VPNs in tunnel mode, except in the case of IP-in-IP, the traffic is unencrypted. As specified, the protocol unwraps the inner IP packet and forwards this packet through IP routing tables, potentially providing unexpected access to network paths available to the vulnerable device. An IP-in-IP device is considered to be vulnerable if it accepts IP-in-IP packets from any source to any destination without explicit configuration between the specified source and destination IP addresses. This unexpected Data Processing Error (CWE-19) by a vulnerable device can be abused to perform reflective DDoS and in certain scenarios used to bypass network access control lists. Because the forwarded network packet may not be inspected or verified by vulnerable devices, there are possibly other unexpected behaviors that can be abused by an attacker on the target device or the target device’s network environment.

Credit:

The information has been provided by Yannay Livneh

The original article can be found at:https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-ipip-dos-kCT9X4

Details

Multiple products that implement the IP Encapsulation within IP standard (RFC 2003, STD 1) decapsulate and route IP-in-IP traffic without any validation, which could allow an unauthenticated remote attacker to route arbitrary traffic via an exposed network interface and lead to spoofing, access control bypass, and other unexpected network behaviors.

Vulnerable Systems:

IP Encapsulation 

CVE Information:

CVE-2020-10136

Disclosure Timeline:
Published Date:6/2/2020

SecuriTeam

SecuriTeam is a small group within Beyond Security dedicated to bringing you the latest news and utilities in computer security.

Please visit our central security portal at securiteam.com to keep up-to-date with the latest security research and read our archives containing over 10,000 articles about CVEs and zero-day exploits.

Contact Us
Want to learn more? Fill out the form below and we'll be in touch shortly.
By clicking Submit, I agree to the use of my personal data in accordance with the Beyond Security Privacy Policy. Beyond Security will not sell, trade, lease, or rent your personal data to third parties.

Advertisement

Vector image of purple colored handshake icon

Affected by Covid-19? Get free vulnerability scanning.

Before You go

Take a second to book a demo. Learn how to secure your networks & applications.

We'll be in touch!

We now have the ability to scan at any time...like having sonar on our own network. We always know what is going on around us.”

man-img

Mike Gutknecht, Spectrum Brands