4 ms·

Interesting that they say the combination of setting is uncommon but somehow I had it set on my RB5009 running 7.9.0 IMHO it's disturbing that any component of

Interesting that they say the combination of setting is uncommon but somehow I had it set on my RB5009 running 7.9.0 IMHO it's disturbing that any component of the IPv6 stack can be exploited even with /ipv6/settings/disable-ipv6 yes There also seems to be a disagreement between Mikrotik and the researchers about whether the vuln was actually disclosed in Dec. Hopefully some more info comes out regarding that.

cookiengineer 3y ago
You're in for a treat: Google for "icmpv6 vulnerability" ... There is just so many bad neighbor discovery related RCEs, it makes my heart bleed. Even tcpdump was too naively implemented at some point.
crest 3y ago
The report says it can be exploited with IPv6 enabled, but IPv6 forwarding disabled and reception of router advertisements conditional on the this aka stop looking at router advertisements if the system is configured as IPv6 router.
- ghostpepper 3y ago
  Maybe the blog post is just ambiguously worded but I'd like a confirmation from them if so. You are only affected if one of the below settings is applied: ipv6/settings/ set accept-router-advertisements=yes or ipv6/settings/set forward=no accept-router-advertisements=yes-if-forwarding-disabled Specifically I'd like to know whether this config is vulnerable: /ipv6/settings/set disable-ipv6=yes forward=no accept-router-advertisements=yes-if-forwarding-disabled
  - bombcar 3y ago
    It is ambiguous but I'd hope that disable-ipv6 would override everything else. I had /ipv6/settings/print disable-ipv6: no forward: yes accept-redirects: yes-if-forwarding-disabled accept-router-advertisements: yes-if-forwarding-disabled max-neighbor-entries: 8192 which I interpreted as "maybe" being ok? But I upgraded anyway.
  - crest 3y ago
    Run `/ipv6/settings/export verbose` to show you the combination of your configuration and the default values on the relevant subtree. I would've expected the `disable-ipv6` to disable all ICMPv6 processing including the code paths leading to the RCE vulnerability, but the post doesn't state it explicitly.
dboreham 3y ago
> disagreement between Mikrotik and the researchers about whether the vuln was actually disclosed in Dec It seems likely that it was not properly disclosed because according to https://mikrotik.com/supportsec https://mikrotik.com/supportsec "you will be notified within 48 hours with acknowledgement of the issue" , but the reporter's web site states "ZDI reported the vulnerability to the vendor during Pwn2Own Toronto". According to MT, none of their staff attended that event. https://www.zerodayinitiative.com/advisories/ZDI-23-710/ https://www.zerodayinitiative.com/advisories/ZDI-23-710/
mannyv 3y ago
I would like to assume disabling ipv6 turns off all the related daemons, but it's not explicitly stated anywhere.

cookiengineer 3y ago

You're in for a treat: Google for "icmpv6 vulnerability" ... There is just so many bad neighbor discovery related RCEs, it makes my heart bleed. Even tcpdump was too naively implemented at some point.

crest 3y ago

The report says it can be exploited with IPv6 enabled, but IPv6 forwarding disabled and reception of router advertisements conditional on the this aka stop looking at router advertisements if the system is configured as IPv6 router.

ghostpepper 3y ago
Maybe the blog post is just ambiguously worded but I'd like a confirmation from them if so. You are only affected if one of the below settings is applied: ipv6/settings/ set accept-router-advertisements=yes or ipv6/settings/set forward=no accept-router-advertisements=yes-if-forwarding-disabled Specifically I'd like to know whether this config is vulnerable: /ipv6/settings/set disable-ipv6=yes forward=no accept-router-advertisements=yes-if-forwarding-disabled
- bombcar 3y ago
  It is ambiguous but I'd hope that disable-ipv6 would override everything else. I had /ipv6/settings/print disable-ipv6: no forward: yes accept-redirects: yes-if-forwarding-disabled accept-router-advertisements: yes-if-forwarding-disabled max-neighbor-entries: 8192 which I interpreted as "maybe" being ok? But I upgraded anyway.
- crest 3y ago
  Run `/ipv6/settings/export verbose` to show you the combination of your configuration and the default values on the relevant subtree. I would've expected the `disable-ipv6` to disable all ICMPv6 processing including the code paths leading to the RCE vulnerability, but the post doesn't state it explicitly.

dboreham 3y ago

> disagreement between Mikrotik and the researchers about whether the vuln was actually disclosed in Dec It seems likely that it was not properly disclosed because according to https://mikrotik.com/supportsec https://mikrotik.com/supportsec "you will be notified within 48 hours with acknowledgement of the issue" , but the reporter's web site states "ZDI reported the vulnerability to the vendor during Pwn2Own Toronto". According to MT, none of their staff attended that event. https://www.zerodayinitiative.com/advisories/ZDI-23-710/ https://www.zerodayinitiative.com/advisories/ZDI-23-710/

mannyv 3y ago

I would like to assume disabling ipv6 turns off all the related daemons, but it's not explicitly stated anywhere.