Subject: [Isis-wg] ISIS MIB changes for Security Section

From: "Parker, Jeff" <[email-masked]>
Date: Fri, 23 Dec 2005 13:43:20 -0500

I have made edits to the ISIS mib security section.  I have enclosed a new
version of the draft.  There are no mib changes.  The changes are in the
Security section are reproduced below.

I am forwarding the draft to the IETF as well as to the MIB reviewers.

- jdp

7. Security Considerations

   Management information defined in this MIB may be considered
   sensitive in some network environments.

   7.1 Discussion

   This MIB may be used to manage an IP router, which is used to direct
   network traffic.  The control of network traffic allows an attacker
   to deny service to a region of the network or to forward traffic to
   adversaries.  By raising or lowering metrics, traffic may be directed
   to insecure portions of the network.  By disabling the protocol on an
   interface, the network may be partitioned.  Changes to the network
   topology will force all routers to recompute their routes.  Periodic
   route changes have brought down networks in the past by subjecting
   routers to stressful recomputations.

Expires June 2006                                      [Page 97]


Internet Draft - draft-ietf-isis-wg-mib-25.txt             December 2005

   There are a number of management objects defined in this MIB that
   have a MAX-ACCESS clause of read-write and/or read-create.  Such
   objects may be considered sensitive or vulnerable in some network
   environments.  The support for SET operations in a non-secure
   environment without proper protection can have a negative effect on
   network operations.  Authentication of received SNMP requests and
   controlled access to management information should be employed in
   such environments.

   We identify a set of threats, and then list attributes that can be
   used in each form of attack.  We discuss the effects that can be
   obtained by a single change to the variable in each class.

   7.2 Threats

         - Drop an Adjacency
         - Drop all Peers
         - Drop Subnetwork
         - Split the Network
         - Intermittent Outages
         - Redirect Traffic
         - Delay Convergence
         - Avoid Detection
         - Prevent Updates
         - Hijack LAN
         - Create problems for CLNS networks

   7.2.1 Drop an Adjacency

   By changing attributes that are used to peer, we can disrupt an
   adjacency and bring a link down.

           isisCirc3WayEnabled OBJECT-TYPE
           isisCircAdminState OBJECT-TYPE
           isisCircExistState OBJECT-TYPE
           isisCircLevelDRHelloTimer OBJECT-TYPE
           isisCircLevelHelloTimer OBJECT-TYPE
           isisCircLevelType OBJECT-TYPE
           isisCircSmallHellos OBJECT-TYPE

   7.2.2 Drop All Adjacencies

   These attributes can be used to break some or all of a router's
   adjacencies.  In the case of System ID, the adjacency may be
   restored.  However, it will subject the network to additional stress.

           isisSysLevelType OBJECT-TYPE
           isisManAreaAddrExistState OBJECT-TYPE

Expires June 2006                                      [Page 98]


Internet Draft - draft-ietf-isis-wg-mib-25.txt             December 2005

           isisSysAdminState OBJECT-TYPE
           isisSysID OBJECT-TYPE

   7.2.3 Drop Subnetwork

   This attribute can be used to stop advertisement of a subnetwork
   reachable through a single interface.

           isisCircPassiveCircuit OBJECT-TYPE

   7.2.4 Split the Network

   If the network design depends upon Wide Metrics or TE, we can use
   these attributes to prevent traffic from passing through a router.

           isisSysLevelMetricStyle OBJECT-TYPE
           isisSysLevelOrigLSPBuffSize OBJECT-TYPE
           isisSysLevelSPFConsiders OBJECT-TYPE
           isisSysLevelTEEnabled OBJECT-TYPE
           isisSysReceiveLSPBufferSize OBJECT-TYPE

   7.2.5 Intermittent Outages

   We can use these attributes to subject the network to a series of
   topology changes, or otherwise force extensive recomputations of
   routes.

           isisSysLevelMinLSPGenInt OBJECT-TYPE
           isisSysLevelSetOverload OBJECT-TYPE
           isisSysLevelSetOverloadUntil OBJECT-TYPE
           isisSysMaxAge OBJECT-TYPE
           isisSysMaxLSPGenInt OBJECT-TYPE
           isisSysL2toL1Leaking OBJECT-TYPE
           isisSysID OBJECT-TYPE

   7.2.6 Redirect Traffic

   By changing attributes such as metrics, we can push traffic to
   different parts of the network.  This may allow an intruder to
   observe data traffic from otherwise remote parts of the network.

   We may also use these attributes to deny service to parts of the
   network.

           isisSysMaxPathSplits OBJECT-TYPE
           isisCircLevelMetric OBJECT-TYPE
           isisCircLevelWideMetric OBJECT-TYPE
           isisIPRAAdminState OBJECT-TYPE

Expires June 2006                                      [Page 99]


Internet Draft - draft-ietf-isis-wg-mib-25.txt             December 2005

           isisIPRAExistState OBJECT-TYPE
           isisIPRAFullMetric OBJECT-TYPE
           isisIPRAMetric OBJECT-TYPE
           isisIPRAMetricType OBJECT-TYPE
           isisIPRANextHop OBJECT-TYPE
           isisIPRANextHopType OBJECT-TYPE
           isisIPRASNPAAddress OBJECT-TYPE
           isisIPRAType OBJECT-TYPE
           isisRedistributeAddrExistState OBJECT-TYPE
           isisSummAddrExistState OBJECT-TYPE
           isisSummAddrFullMetric OBJECT-TYPE
           isisSummAddrMetric OBJECT-TYPE
           isisSysL2toL1Leaking OBJECT-TYPE

   7.2.7 Delay Convergence

   These attributes can be used to slow convergence by increasing the
   minimal interval required to update a packet.

           isisCircLevelCSNPInterval OBJECT-TYPE
           isisCircLevelLSPThrottle OBJECT-TYPE
           isisCircLevelMinLSPRetransInt OBJECT-TYPE
           isisCircLevelPartSNPInterval OBJECT-TYPE
           isisSysWaitTime OBJECT-TYPE
           isisCircPassiveCircuit OBJECT-TYPE

   7.2.8 Avoid Detection

   By turning off traps, we can prevent a Network Management station
   from observing problems in the network caused by other aspects of an
   attack.

           isisSysNotificationEnable OBJECT-TYPE

   7.2.9 Prevent Updates

   Mesh Groups can be used to prevent the transmission of Link State
   PDUs on certain interfaces, delaying or preventing the propagation of
   updates.

           isisCircMeshGroup OBJECT-TYPE
           isisCircMeshGroupEnabled OBJECT-TYPE

   7.2.10 Hijack LAN

   If we have compromised a router, we can use this attribute to become
   the designated router and lie about the topology of a LAN.

Expires June 2006                                     [Page 100]


Internet Draft - draft-ietf-isis-wg-mib-25.txt             December 2005

           isisCircLevelISPriority OBJECT-TYPE

   7.2.11 Create problems for CLNS networks

   This attribute can be used to modify the handling of CLNS traffic.

           isisRAAddrPrefix OBJECT-TYPE
           isisRAAdminState OBJECT-TYPE
           isisRAExistState OBJECT-TYPE
           isisRAMapType OBJECT-TYPE
           isisRAMetric OBJECT-TYPE
           isisRAMetricType OBJECT-TYPE
           isisRASNPAAddress OBJECT-TYPE
           isisRASNPAMask OBJECT-TYPE
           isisRASNPAPrefix OBJECT-TYPE
           isisRAType OBJECT-TYPE
           isisSysPollESHelloRate OBJECT-TYPE

   7.2.12 Mostly Harmless

   The following writable attributes do not pose a known security risk.

           isisCircExtDomain OBJECT-TYPE
           isisCircIfIndex OBJECT-TYPE
           isisCircLevelHelloMultiplier OBJECT-TYPE
           isisCircType OBJECT-TYPE

   7.2.13 Recommendations

   Much of the MIB is used to set or read attributes which are readily
   visible to any intruder who has access to traffic.  None of the
   security attributes are setable or visible through the MIB.  Read
   access to the MIB does not pose additional risks or vulnerabilities.

   If write access is to be provided, it is RECOMMENDED that
   implementers consider the security features as provided by the SNMPv3
   framework (see [RFC3410], section 8), including full support for the
   SNMPv3 cryptographic mechanisms (for authentication and privacy).

   SNMP versions prior to SNMPv3 did not include adequate security.
   Even if the network itself is secure (for example by using IPSec),
   even then, there is no control as to who on the secure network is
   allowed to access and GET/SET (read/change/create/delete) the objects
   in this MIB module.

   Deployment of SNMP versions prior to SNMPv3 is NOT RECOMMENDED.
   Instead, it is RECOMMENDED to deploy SNMPv3 and to enable
   cryptographic security.  It is then a customer/operator

Expires June 2006                                     [Page 101]


Internet Draft - draft-ietf-isis-wg-mib-25.txt             December 2005

   responsibility to ensure that the SNMP entity giving access to an
   instance of this MIB module is properly configured to give access to
   the objects only to those principals (users) that have legitimate
   rights to indeed GET or SET (change/create/delete) them.

_______________________________________________
Isis-wg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isis-wg