Re: [Full-disclosure] HP A-series switches are affected, too. [WAS: More on IPv6 RA-Guard evasion (IPv6 security)]

[Dan Luedtke <maildanrl@xxxxxxxxxxxxxx>]

Hello Fernando, hello list,

you addressed a problem that many vendors suffer from at the moment.
Marc Heuse discovered this vulnerability, i guess, and he has
published a nice collection of tools to generate the packets mentioned
in your article.
More on that: http://thc.org/thc-ipv6/

Based on Marc's ideas I tested the mentioned attack on Hewlett
Packard's A-series switches, and I have to say that these attacks were
successful. That stopped us from implementing IPv6 for a while in our
network.

If you are interested, you can obtain my thesis as PDF-document here
https://www.danrl.de/dl/bachelor-thesis-luedtke.pdf
(Chapter Edge-Level might be the one of your interest)

By the way, I don't think it is a good idea to disallow any Extension
Headers in ND-Messages, I'd like switches to discard ND-Messages with
more that e.g. 3 chained headers. But that is another conversation...
I subscribed to the IPv6 Hackers mailing list, maybe we will have some
discussion about that over there.


regards,
  danrl

--
danrl / Dan Luedtke
http://www.danrl.de