CRSA-2015-0001.yaml

title: 'OpenDaylight openflowplugin allows topology spoofing via LLDP'

description: 'It has been reported that it is possible for an attacker to spoof
  networking topology via LLDP. An attacker can inject crafted LLDP packets that
  announce internal links between switches, thereby affecting the flow of data in
  the SDN network. Further technical details are available in a conference paper.'

references: 
  - http://www.internetsociety.org/sites/default/files/10_4_2.pdf

affected-products:

  - product: CloudRouter
    version:
      - id: 1.0-beta
        component: opendaylight-helium
        issues:
          - 7
        patches:
          - https://git.opendaylight.org/gerrit/#/c/16193/
          - https://git.opendaylight.org/gerrit/#/c/16208/

vulnerabilities:

  - cve-id: CVE-2015-1611
    cloudrouter-security-issue: 1
    impact-assessment:
      source: 'IIX Product Security'
      rating: moderate
      assessment:
        type: CVSS2
        score: 4.3
        detail: AV:A/AC:M/Au:N/C:N/I:P/A:P
    classification:
      source: 'IIX Product Security'
      type: CWE
      detail: TODO
  - cve-id: CVE-2015-1612
    impact-assessment:
      source: 'IIX Product Security'
      rating: moderate
      assessment:
        type: CVSS2
        score: 4.3
        detail: AV:A/AC:M/Au:N/C:N/I:P/A:P
    classification:
      source: 'IIX Product Security'
      type: CWE
      detail: TODO

reporters:

  - name: 'Lei Xu'
    affiliation: 'Texas A&M'
    reported:
      - CVE-2015-1611
      - CVE-2015-1612