Skip to content
OpenAdvisories
Medium WID-SEC-2025-0126 4 CVEs

Verschiedene Tunneling Protokolle: Mehrere Schwachstellen

Published Jan 19, 2025 · Updated Jan 19, 2025 · de-DE

Vendor: Specification Product: Tunneling Protocol

Summary

Ein Angreifer kann mehrere Schwachstellen in verschiedenen Tunneling Protokollen (GRE/IPIP/4in6/6in4) ausnutzen, um einen Spoofing-Angriff durchzuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand zu erzeugen und andere nicht spezifizierte Angriffe durchzuführen.

Product

Tunneling-Protokolle sind Netzwerktechnologien, die verwendet werden, um Datenpakete innerhalb eines anderen Protokolls zu übertragen.

Vulnerabilities 4

  • Medium 5.4
    CVE-2025-23018

    IPv4-in-IPv6 and IPv6-in-IPv6 tunneling (RFC 2473) do not require the validation or verification of the source of a net…

    IETF IPv6
  • Medium 5.4
    CVE-2025-23019

    IPv6-in-IPv4 tunneling (RFC 4213) allows an attacker to spoof and route traffic via an exposed network interface.

    IETF IPv6
  • Medium 5.3
    CVE-2024-7595 Public exploit

    GRE and GRE6 Protocols (RFC2784) do not validate or verify the source of a network packet

    GRE and GRE6 Protocols (RFC2784) do not validate or verify the source of a network packet allowing an attacker to spoof and route arbitrary traffic via an exposed network interface that can lead to spoofing, access control bypass, and other unexpected network…

    IETF RFC2784 - Generic Routing Encapsulation (GRE)
  • Medium 5.3
    CVE-2024-7596

    Generic UDP Encapsulation (GUE) (IETF Draft) do not validate or verify the source of a network packet

    Proposed Generic UDP Encapsulation (GUE) (IETF Draft) do not validate or verify the source of a network packet allowing an attacker to spoof and route arbitrary traffic via an exposed network interface that can lead to spoofing, access control bypass, and oth…

    IETF draft-ietf-intarea-gue-09

Revision history

  1. #1

    Initiale Fassung

References