Twenty Year Anniversary

ICMPv6 Router Announcement Flooding Denial Of Service

ICMPv6 Router Announcement Flooding Denial Of Service
Posted Apr 6, 2011
Authored by van Hauser

An ICMPv6 router announcement flooding denial of service vulnerability affects multiple systems including Cisco, Juniper, Microsoft, and FreeBSD. Cisco has addressed the issue but Microsoft has decided to ignore it.

tags | advisory, denial of service
systems | cisco, freebsd, juniper
advisories | CVE-2010-4670, CVE-2010-4671, CVE-2010-4669
MD5 | f9b4dca38772e20b8831879129a179ba

ICMPv6 Router Announcement Flooding Denial Of Service

Change Mirror Download
This security advisory is released because Microsoft doesnt want to fix
the issue. Cisco did for its IOS and ASA within 3 months.


Title: ICMPv6 Router Announcement flooding denial of service affecting
multiple systems
Date: 05 April 2011


Vendors: Cisco, Juniper, Microsoft, FreeBSD
Affected Products: All Cisco IOS ASA with firmware < November 2010
All Netscreen versions
All Windows versions
All FreeBSD version
Vulnerability: ICMPv6 Router Announcement flooding denial of service
Severity: 7.8 (CVE CVSS Score), local network
CVEs: CVE-2010-4670, CVE-2010-4671, CVE-2010-4669


Update Section:

05 April 2011
Initial release



When flooding the local network with random router advertisements,
hosts and routers update the network information, consuming all
available CPU resources, making the systems unusable and unresponsive.
As IPv6 and autoconfiguration are enabled by default, all are
affected in their default configuration.
For Windows, a personal firewall or similar security product does not
protect against this attack.

Note: Microsoft does not want to fix this security issue for their


Updating the routing tables and configuring IPv6 addresses take up
all available CPU resources.
Routers and firewalls do not forward traffic.

The denial of service is in affect until the flooding is terminated.

The exact impact differs from the affected system type:
Cisco: 100% traffic loss with autconfiguration active, 80% without.
Netscreen: Only affected when the interface is configured as host, traffic
is forwarded until the neighbor information times out, then the traffic
is lost
Windows: 100% CPU, 100% RAM
FreeBSD: 100% CPU, additionally IPv6 support can be lost until reboot
Old Linux kernels are also affected, detailed version information unknown.


On IPv6 networks, hosts automatically find out about available
routers via ICMPv6 router announcements which are sent by the
routers. Additionally, router announcemens are used to replace
DHCP by the so called autoconfiguration feature.

Windows and FreeBSD - like all modern operating systems - enable
IPv6 and autoconfiguration by default and are thereby vulnerable.
A personal firewall will not protect against this attack.

If a system receives a router announcement of a new router, it
updates its routing table with the new router, and if the
autoconfiguration flag is set on the announcement (and the host
is configured to configure its IPv6 address by this mechanism),
the host chooses an IPv6 address from the announced network space.

If a network is flooded with random router announcements, systems
scramble to update their routing tables and configure IPv6


Flood the network with router advertisements coming from different
routers and announcing different network prefixes.

A tool to test for this vulnerability is included in the thc-ipv6
package, called flood_router6.


Cisco: IOS fix CSCti24526 , ASA fix CSCti33534
Linux: fixed prior 2010
Netscreen: Juniper waiting for IETF results for how to fix the issue
FreeBSD: unknown
Windows: Microsoft made clear that they do not plan to issue a
fix for this security issue.


The procession of router announcements must be disabled.
Please consult your system manual on how to this for your
affected platform.
Alternatively, disable IPv6.


Vendor communication:

10 July 2010 Microsoft informed

10 July 2010 Cisco informed

01 August 2010 Cisco confirms problem, announces fix for October

12 August 2010 Microsoft confirms vulnerability, states no fix
will be supplied.

22 November 2010 Cisco confirms fixes are available and started to
be deployed in current firmwares

28 December 2010 vendor-sec informed (among other issues)

05 February 2011 FreeBSD informed (made aware via vendor-sec 5 weeks

20 February 2011 Juniper informed

09 March 2011 Juniper confirms problem

01 April 2011 Juniper informs that they work with the IETF to
develop a standard method to cope with this and
similar attacks.



Marc Heuse


The information provided is released "as is" without warranty of
any kind. The publisher disclaims all warranties, either express or
implied, including all warranties of merchantability.
No responsibility is taken for the correctness of this information.
In no event shall the publisher be liable for any damages whatsoever
including direct, indirect, incidental, consequential, loss of
business profits or special damages, even if the publisher has been
advised of the possibility of such damages.

The contents of this advisory is copyright (c) 2010,2011 by Marc Heuse
and may be distributed freely provided that no fee is charged for
the distribution and proper credit is given.


Marc Heuse

PGP: FEDD 5B50 C087 F8DF 5CB9 876F 7FDD E533 BF4F 891A


RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

Want To Donate?

Bitcoin: 18PFeCVLwpmaBuQqd5xAYZ8bZdvbyEWMmU

File Archive:

July 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    1 Files
  • 2
    Jul 2nd
    26 Files
  • 3
    Jul 3rd
    15 Files
  • 4
    Jul 4th
    11 Files
  • 5
    Jul 5th
    13 Files
  • 6
    Jul 6th
    4 Files
  • 7
    Jul 7th
    4 Files
  • 8
    Jul 8th
    1 Files
  • 9
    Jul 9th
    16 Files
  • 10
    Jul 10th
    15 Files
  • 11
    Jul 11th
    32 Files
  • 12
    Jul 12th
    22 Files
  • 13
    Jul 13th
    15 Files
  • 14
    Jul 14th
    1 Files
  • 15
    Jul 15th
    1 Files
  • 16
    Jul 16th
    21 Files
  • 17
    Jul 17th
    10 Files
  • 18
    Jul 18th
    0 Files
  • 19
    Jul 19th
    0 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags


packet storm

© 2018 Packet Storm. All rights reserved.

Security Services
Hosting By