Running IPv6 on Mikrotik? You're out of business in 12 days time

RouterOS General
1

Yes, really, it’s that serious!

It seems there is a bug in ROS that allows a remote attacker to crash any Mikrotik device if they can access it via v6. Even with firewalling you are still a sitting duck. Mikrotik have known about this for a year and have done nothing to fix it.

This information is due to be released to the public at UKNOF on 9th April. Yes, in 12 days anyone with a slight bit of knowledge about networks and a v6-enabled connection will be able to take any Mikrotik device (running v6) offline. No doubt an exploit script will follow soon after.

As a community it is absolutely critical that we push Mikrotik for a solution to this problem as a matter of upmost urgency. The consequences of this getting out into the wild before a fix is available would be disastrous for all of us. Please everyone pay attention and help in making sure Mikrotik understand just how critical this problem is.

There is a thread already running on this (http://forum.mikrotik.com/t/uknof-43-cve/128988/1) but the subject is such that most people will probably skip over it.

UKNOF presentation where this issue will be disclosed in full: https://indico.uknof.org.uk/event/46/contributions/667/
CVE report: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19299

2

Somehow this is the first I’ve heard of this and I’m very concerned as I have a modern network that includes IPv6. You’re saying Mikrotik have known about this for 50 weeks and it hasn’t been fixed?!? What is going on over there?!

This is a completely unacceptable response for a security vulnerability. I think it’s time for me to start moving away from RouterOS, either to OpenWRT or a different vendor that cares about security.

3

This is also a new one for me…will be digging into it

4

Something similar (if not the same) had been already discussed in this forum.

5

In a nutshell, it’s a memory exhaustion issue. You send a v6 packet formed in a certain way (which I assume will be revealed on 9th April) to a Mikrotik router and the kernel leaks a bit of memory. When memory runs out the router crashes, I assume until the watchdog reboots it. There is no way to firewall as whatever this characteristic is that causes the problem can be set with any v6 packet.

6

I believe that thread refers to CVE-2018-19298 which is a similar incident. The later one (CVE-2018-19299) is far more sinister.

7

Even if there is no way to firewall it on a MikroTik, i’m assuming that once we know what is being set in the packet header, it can be mitigated with another solution based on flow detection and dropping the traffic in a switch. That won’t work for everyone obviously, but it would work for a lot of the ISP and DC networks I consult on.

8

Let’s hope MikroTik can have a build ready with a fix before the full details of this go public…

9

That is exactly what we are all hoping for. Unfortunately the silence from Mikrotik does not fill me with confidence that they even understand how bad this problem could turn out.

10

If this is true, then WTF are they even thinking?!
This only sends all the bad messaging: If you want a bug to be fixed, release it as zero day exploit. Doing it nice and proper way gets you nowhere…

11

In this thread there two issues listed: nd cache & routing / stateful connection exhaustion. Which is is referred here?

First can be mitigated by state-full firewall which most end users will use. For non-end-user, address restrictions can help / resolve issue.
Second wasn’t clarified what the actual issue was.

12

I’d like to add my voice to the Mikrotik community stating this must be addressed before public release.

Tim

13 
/ipv6 export file=hahahanoipv6foryou.rsc
/system package disable [find name=ipv6]
/system reboot

Thankfully I’m in the position to do the above (and just have on my edge routers, in fact). I am nothing short of apoplectic that I’ve had to, however. Secretly hoping that either 6.44.1 was a fix for this or that it’s a complete hoax. Either is better than what appears to be reality.

Edit: It really is about time v6 stops being such a second-class citizen on RouterOS. I’m a proper advocate for it but when MikroTik pull this kind of stunt it makes you start questioning your decisions.

14

Guess we won’t be deploying IPv6 Q2 2019

15

Interesting to say the least.

We have quite a number of networks we have deployed IPv6 into.
I always wish when things like this happened I knew more to be able to protect our clients - but of course that is the nature of the beast.

Hoping Mikrotik can patch the issue.

IPArchitects has a decent idea in regards to switch path in front of the routers as a possible solution to help direct traffic.

Time will tell I guess

16

Thanks for info

shock for me :open_mouth: :open_mouth: :open_mouth:

17

Don’t worry you can use kid control on your core routers to block them. :stuck_out_tongue:

Seriously though, what is up over @ MT ?

18

IPv6 isn’t even out of beta yet, so no worries.

19

Glad I have not even turned on ipv6 packages yet, that link from mkx was back in 2017?? 50 days, how bout 2 years.

20

Facts still have to matter. The narrative, response and criticism over this issue has gotten way ahead of the information available. Specially crafted packet / memory exhaustion issues (or any other vulnerability) are nothing new to even the largest network equipment manufacturers. They can be dealt with, and are done so routinely.

The common practice to go public with a vulnerability is to do it in coordination with affected vendor, and their release of a fix. To do otherwise is irresponsible and unprofessional.