RIP Poisoning -- What's the 'worst case senario'?

[jmpebx]

I've got a client where an internal scan said one of their core routers has a RIP-2 Poisoning issue.

This is the exact Nessus description:
Tenable Network Security

I understand that an attacker could create bogus routes, but what's the worst case scenario?
Any traffic on the LAN isn't going to be routed anyway, so any LAN traffic should be effected by this right?
You could do a man in the middle with WAN traffic, you could intercept emails. Anything else?


.

[thorin]

1) Do some reading about RIP-2 and find out if the agent in question requires the authentication the Nessus plugin talks about.
2) If traffic on the LAN isn't routed how is it going to get anywhere?
3) If the system in question is a router then this is a big deal as you can re-route or alter traffic crossing the device. If the system in question is a single workstation then you'll only be able to affect traffic to/from said workstation.

[voidnecron]

I think what he means with LAN traffic not being routed is that it broadcasts its way around the LAN, not necessarily needing a router.

[Clonmac]

JMPEBX, be careful not to immediately assume that your internal network will not be affected by a routing protocol compromise too. Depending on your internal network topology and what devices are actually using a vulnerable routing protocol, you could summarize internal networks differently than how they're intended to be and actually route internal traffic to different destinations. It all depends on their internal network topology and what devices are actually using the routing protocol in question.

A routing protocol compromise can result in a DoS and in a worst case scenario your entire network security could be compromised.