Preemptive Protection against Cisco IOS Malformed BGP Packet Denial of Service

The Border Gateway Protocol (BGP) is a routing protocol designed to manage IP routing in large networks. An affected Cisco device running a vulnerable version of Cisco IOS software with the BGP protocol enabled will reload if a malformed BGP packet is already queued on the interface when a BGP neighbor change is logged. Malformed packets may not necessarily come from malicious sources; a valid peering device such as another BGP router which produces the specific malformed packet in error may trigger this behavior.

Using SmartView Tracker, users of R55, R55W and InterSpect who have performed the solution outlined below, will identify attack attempts by the following logging information:

Name: MD5 Authenticated BGP enforcement violation
Information: Non-MD5 authenticated BGP protocol detected on connection

Users of VPN-1 NG with Application Intelligence R55 will receive rule 99179 on the SmartView Tracker.

Check Point has provided a solution for this problem since July 2004. To prevent the spoofing or modification of a valid BGP message, BGP traffic is verified for message authentication (MD5). The protection applies to the routing protocols RIP and OSPF as well.    

To verify that your SmartDefense Routing Protocols protection is enabled, please refer to CPSA-2004-03.