mailing list archives
Cisco HSRP Weakness/DoS
From: bashis <bash () NS WCD SE>
Date: Thu, 3 May 2001 19:57:41 +0200
I was playing with Cisco's HSRP (Hot Standby Routing Protocol),
and there is a (major) weakness in that protocol that allow
any host in a LAN segment to make a HSRP DoS.
Short (very) explain of HSRP.
HSRP uses UDP on port 1985 to multicast address 220.127.116.11,
and the authentication is in clear text. (default: cisco)
I include a small program that sends out a fake HSRP packet,
when it hear a legal HSRP packet, as a "proof of concept" code...
Vendor was notified about this 14 April 2001,,
and their response was to use HSRP with IPSec.
[cut from src]
* This code listen for any HSRP packet, when it hear one HSRP packet,
* it capture this, modifies some of HSRP protocol parameters, and send out
* a fake HSRP packet that tells other routers that I am the active router,
* I have highest priority and you should be 'Standby' or silent..
* If the other active, and legal router has highest possible
* priority (255), then they will fight.. ;-) , AND it seems
* in my tests that the legal router who 'wishes' be active router,
* IS allready active, so no DoS will occure. (only UDP flood from both)
Description: gzip compressed data, deflated, last modified: Thu May 3 20:02:56 2001, os: Unix
- Cisco HSRP Weakness/DoS bashis (May 04)