Description
Layer 2 network filtering capabilities such as IPv6 RA guard can be bypassed using combinations of VLAN 0 headers, LLC/SNAP headers, and converting frames from Ethernet to Wifi and its reverse.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| IETF | P802.1Q | D1.0 – ≤ D1.0 | — |
| IETF | draft-ietf-v6ops-ra-guard | 08 – ≤ 08 | — |
| IEEE | 802.2 | 802.2h-1997 – ≤ 802.2h-1997 | — |
Advisories 1
- WID-SEC-2022-1551 Layer 2 Netzwerksicherheitskontrollen: Mehrere Schwachstellen ermöglichen Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Oct 4, 2023