Contributed by deanna on from the meta errata dept.
Recently at the CanSecWest conference in Vancouver a fundamental design flaw in the IPv6 protocol was exposed. The problem lies in the routing header 0 of an IPv6 packet which lets the sending party control the path of a packet, which is potentially very dangerous (for further analyses of the problem see the paper from CanSecWest here).
Shortly afterwards Jun Ichiro Itojun Hagino of Kame and OpenBSD took action and it was disabled. After this some heated discussion took place on the IETF mailing lists and now it is looking like the IETF may actually react and do something about it, as reported by Securityfocus.
(Comments are closed)
By Krunch (213.219.186.239) on
Comments
By Anonymous Coward (216.62.11.163) on
That's the joke of this whole mess. Everyone knew it was bad before it got put in the specs.
By henning (80.51.253.154) henning@ on
yes, you are missing something - this is just like the v4 source routing mess, but 1000 times worse. as in, the consequences are/can be 1000 times worse.
By Dean (63.227.27.147) on
Comments
By Anonymous Coward (212.251.125.47) on
>
>
i thought the same, but thank god its just old news
By Rod Whitworth (yendor) undead.w.wtw@xoxy.net on
At Ruxcon 2006 in Sydney the following presentation was given:
IPV6: Under the Hood - Mark Dowd
For years, Internet communications have relied upon the IPv4 protocol as an underlying transport facility to allow data exchange between distant nodes. Although it has enjoyed immense success, IPv4 fails to meet some requirements for modern communications due to changing needs and technological advancements. As such, a new IP protocol (IPv6) has been under development for quite some time to address some of the shortcomings of IPv4. Specifically, IPv6 boasts speed enhancements, security improvements, configuration improvements, and larger address spaces. However, these improvements don't come at no cost; they introduce a large amount of functionality that might be of interest to hackers wishing to subvert firewalls, create covert communication channels, and discover information about other hosts. Furthermore, most IPv4 stacks have undergone major scrutiny for security problems and are at a fairly mature stage in their life cycles. IPv6 stacks, conversely, are in their infancy and haven't stood the rigorous test of time. In this speech, I will outline some of the basics of IPv6 functionality and discuss some potential problem areas that abusing these features might cause. In addition, you will see some of the common types of implementation flaws that can be made when developing IPv6 protocol stacks and how these problems might be leveraged to attack unprotected hosts or firewalls.
A copy of the slides can be found at:
http://ruxcon.org.au/files/2006/dowd_ipv6.ppt
Comments
By SyNko (212.29.133.34) on
>
> At Ruxcon 2006 in Sydney the following presentation was given:
>
> IPV6: Under the Hood - Mark Dowd
>
> For years, Internet communications have relied upon the IPv4 protocol as an underlying transport facility to allow data exchange between distant nodes. Although it has enjoyed immense success, IPv4 fails to meet some requirements for modern communications due to changing needs and technological advancements. As such, a new IP protocol (IPv6) has been under development for quite some time to address some of the shortcomings of IPv4. Specifically, IPv6 boasts speed enhancements, security improvements, configuration improvements, and larger address spaces. However, these improvements don't come at no cost; they introduce a large amount of functionality that might be of interest to hackers wishing to subvert firewalls, create covert communication channels, and discover information about other hosts. Furthermore, most IPv4 stacks have undergone major scrutiny for security problems and are at a fairly mature stage in their life cycles. IPv6 stacks, conversely, are in their infancy and haven't stood the rigorous test of time. In this speech, I will outline some of the basics of IPv6 functionality and discuss some potential problem areas that abusing these features might cause. In addition, you will see some of the common types of implementation flaws that can be made when developing IPv6 protocol stacks and how these problems might be leveraged to attack unprotected hosts or firewalls.
thats right!!! tnx u man