CVE-2019-11189 : Exploit Details and Defense Strategies

In ONOS v2.0 and earlier, an authentication bypass vulnerability has been identified in org.onosproject.acl and org.onosproject.mobility modules. This vulnerability allows attackers to bypass network access control by injecting data plane packets. To exploit this vulnerability, the attacker sends a gratuitous ARP reply, which triggers the removal of existing access control flow denial rules in the network by the host mobility application. Since the access control application does not re-install these flow deny rules, the attacker can effectively bypass the intended access control policy.

Understanding CVE-2019-11189

This section provides insights into the nature and impact of the CVE-2019-11189 vulnerability.

What is CVE-2019-11189?

CVE-2019-11189 is an authentication bypass vulnerability present in the org.onosproject.acl and org.onosproject.mobility modules of ONOS v2.0 and earlier versions. It enables attackers to circumvent network access control mechanisms by injecting data plane packets.

The Impact of CVE-2019-11189

The vulnerability allows malicious actors to bypass intended access control policies by exploiting weaknesses in the network's flow denial rules. By sending a specific ARP reply, attackers can manipulate the host mobility application to remove critical access control restrictions, leading to unauthorized network access.

Technical Details of CVE-2019-11189

Explore the technical aspects and implications of CVE-2019-11189.

Vulnerability Description

The vulnerability in org.onosproject.acl and org.onosproject.mobility modules permits unauthorized network access by manipulating access control flow denial rules through a crafted ARP reply.

Affected Systems and Versions

Systems running ONOS v2.0 and earlier versions

Exploitation Mechanism

Attacker sends a gratuitous ARP reply
Triggers removal of access control flow denial rules by host mobility application
Access control application fails to re-install flow deny rules, allowing the attacker to bypass security measures

Mitigation and Prevention

Learn how to mitigate the risks associated with CVE-2019-11189.

Immediate Steps to Take

Apply vendor-supplied patches or updates promptly
Implement network segmentation to limit the impact of unauthorized access
Monitor network traffic for suspicious activities

Long-Term Security Practices

Conduct regular security audits and assessments
Educate network administrators and users on best security practices
Employ intrusion detection and prevention systems

Patching and Updates

Regularly check for security advisories from ONOS
Apply patches and updates as soon as they are available to address known vulnerabilities