How to remediate – RIP-2 Poisoning Routing Table Modification

1. Introduction

RIP-2 Poisoning Routing Table Modification concerns a weakness in the Routing Information Protocol version 2. This could allow an attacker on the same network to alter routing information, potentially redirecting network traffic and hijacking connections. Systems running RIP-2 are usually affected, especially older routers or those not actively managed. A successful attack can impact confidentiality, integrity, and availability of network services.

2. Technical Explanation

The vulnerability stems from the lack of mandatory authentication in RIP-2. Without authentication, an attacker can send false routing updates to a host running a RIP-2 agent, causing it to add incorrect routes to its routing table. This allows the attacker to intercept and potentially modify network traffic intended for other destinations. Nessus identifies hosts running a RIP-2 agent but cannot confirm if authentication is enabled in this configuration.

• Root cause: missing or disabled authentication on RIP-2 packets.
• Exploit mechanism: An attacker sends spoofed RIP routing updates with bogus routes to the target host, altering its routing table. For example, an attacker could advertise a route for 192.168.1.0/24 via their own interface, redirecting traffic intended for that network through their machine.
• Scope: Routers and networking devices running RIP-2 are affected. Specific versions depend on the vendor implementation.

3. Detection and Assessment

Confirming vulnerability involves checking if RIP-2 is enabled and whether authentication is active. A quick check can identify the presence of the service, while a thorough assessment requires examining configuration files.

• Quick checks: Use `netstat -an | grep 520` to see if anything is listening on the standard RIP port (UDP 520).
• Scanning: Nessus vulnerability ID [no ID provided]. This should be used as a starting point, but manual verification is recommended.
• Logs and evidence: Check router logs for RIP-related messages. Specific log file names vary by vendor. Look for indications of routing updates being received or sent without authentication.

netstat -an | grep 520

4. Solution / Remediation Steps

The best solution is to disable RIP-2 if it’s not required. If RIP-2 must be used, implement strong authentication. These steps are designed to minimise risk and allow for easy roll back.

4.1 Preparation

• Ensure you have console or SSH access to the router in case of connectivity issues. A roll back plan involves restoring the previous configuration.
• A change window may be required, depending on network impact and approval processes.

4.2 Implementation

1. Step 1: Disable RIP-2 if not needed. This is typically done through the router’s web interface or command line.
2. Step 2: If RIP-2 is required, enable authentication on all interfaces. Configure a strong shared secret key.
3. Step 3: Verify that authentication is working correctly by checking routing updates from other routers.

4.3 Config or Code Example

Before

interface GigabitEthernet0/0
 no ip rip authentication key 

After

interface GigabitEthernet0/0
 ip rip authentication key Cisco123 

4.4 Security Practices Relevant to This Vulnerability

Several security practices can help prevent this issue and similar routing attacks. These are best implemented as part of a broader network security strategy.

• Practice 1: Least privilege – restrict access to router configuration to only authorised personnel.
• Practice 2: Secure defaults – change default passwords and disable unnecessary services like RIP-2 if not used.

4.5 Automation (Optional)

Automation is possible using configuration management tools, but requires careful testing due to the potential for network disruption.

# Example Ansible snippet - use with caution!
- name: Disable RIP on interfaces
  cisco.ios.ios_config:
    lines:
      - no ip rip authentication key
    parents: GigabitEthernet0/0

5. Verification / Validation

Confirm the fix by checking that RIP-2 is disabled or authentication is enabled and functioning correctly. A smoke test should verify basic network connectivity.

• Post-fix check: Run `show ip rip interface` to confirm RIP is disabled on all interfaces, or that authentication keys are configured.
• Re-test: Re-run the Nessus scan to ensure the vulnerability is no longer detected.
• Smoke test: Ping a known destination on the network to verify basic connectivity remains functional.
• Monitoring: Monitor router logs for unexpected RIP messages or routing changes.

show ip rip interface

6. Preventive Measures and Monitoring

Regular security baselines and patch management are essential. Consider adding checks to your CI/CD pipeline to prevent similar misconfigurations.

• Baselines: Update a network security baseline or policy to require disabling unused routing protocols like RIP-2, or enforcing authentication.
• Pipelines: Add configuration validation checks in your deployment pipelines to ensure RIP is either disabled or properly authenticated.
• Asset and patch process: Review router configurations regularly as part of an asset management program.

7. Risks, Side Effects, and Roll Back

Disabling RIP-2 could disrupt existing routing if it’s still in use. Incorrect authentication configuration can also cause connectivity issues. A roll back plan is essential.

• Roll back: Restore the previous router configuration from backup if any issues occur.

8. References and Resources

• Vendor advisory or bulletin: [no link provided]
• NVD or CVE entry: [no link provided]
• Product or platform documentation relevant to the fix: [no link provided]