Gabi Nakibly

Name of the Vulnerable Software and Affected Versions: Open Shortest Path First (OSPF) protocol implementations (affected versions not specified) Description: The issue arises from improper determination of Link State Advertisement (LSA) recency for LSAs with MaxSequenceNumber. According to the protocol, when sequence numbers are the same, the LSA with the larger checksum is considered more recent. An attacker can craft a LSA with MaxSequenceNumber and invalid links, resulting in a larger checksum, which will not be flushed from the Link State Database (LSDB). This can lead to the erasure or alteration of routing tables, causing a denial of service condition or re-routing of traffic. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue arises when a rogue router spoofs its origin, affecting routing tables due to a missing LSA, which may result in loss of connectivity.

The issue is due to improper OSPF implementation, which can be exploited when the device receives special LSA packets, setting the LS age to MaxAge, 3600 seconds. This can lead to route table poisoning and a DoS attack.

The issue allows remote attackers to obtain speech signals from a device's physical environment via a crafted web site that listens for `ondeviceorientation` events. This is achieved by not properly restricting access to high-rate gyroscope data.

The OSPF implementation in Cisco products does not properly validate Link State Advertisement (LSA) type 1 packets before performing operations on the LSA database. This allows remote attackers to cause a denial of service (routing disruption) or obtain sensitive packet information via a unicast or multicast packet. An attacker could trigger this vulnerability by injecting crafted OSPF packets, potentially causing flushing of the routing table on a targeted router and propagation of the crafted OSPF LSA type 1 update throughout the OSPF AS domain.