https://www.exploit-db.com/exploits/19451
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-199908-020

使用ICMP路由器恢复协议的DHCP（IRDP）客户端存在漏洞，远程攻击者可以借助此漏洞修改默认路由。

source: http://www.securityfocus.com/bid/578/info

[This discussion is verbatim from the LHI Advisory referenced in the "Reference Section" of this vulnerability entry with very few changes]

The ICMP Router Discovery Protocol (IRDP) comes enabled by default on DHCP clients that are running Microsoft Windows95 (w/winsock2), Windows95b, Windows98, Windows98se, and Windows2000 machines. By spoofing IRDP Router Advertisements, an attacker can remotely add default route entries on a remote system. The default route entry added by the attacker will be preferred over the default route obtained from the DHCP server. This results in higher susceptibility to denial of service, passive snooping and man in the middle attacks. While Windows 2000 does indeed have IRDP enabled by default, it is less vulnerable as it is impossible to give it a route that is preferred over the default route obtained via DHCP.

SunOS systems will also intentionally use IRDP under specific conditions. For Solaris2.6, the IRDP daemon, in.rdisc, will be started if the following conditions are met:

The system is a host, not a router.
The system did not learn a default gateway from a DHCP server.
The system does not have any static routes.
The system does not have a valid /etc/defaultrouter file. 

L0pht (LHI) has made available Proof-of-Concept code that will let individuals test their systems & firewalls.

Usage is as follows:

Usage: rdp -v -l -s -d <delay> -p <pref> -t <lifetime> -i <dev>
-S <src> -D <dst> -R <rtr> -r <optional 2nd rtr>

-v verbose
-l listen mode
-s send mode
-d <delay time between sending packets>
-n <number of rdp packets to send>
-I <ID value to place in IP packet>
-p <preference level>
-t <lifetime>
-i <interface to use for sniffing>
-S <source address to put in outgoing rdp packet>
-D <destination address to put in outgoing rdp packet>
-R <router address to advertise in rdp packet>
-r <optional 2nd router address to advertise in rdp packet>


Misc software notes:

Listen Mode: Software listens for ICMP Router Solicitations. If the '-s' flag is specified as well, the software will answer the Solicitations with ICMP Router Advertisements.

Preference: If the preference is not specified, it will use a default of 1000, which will give the default route a metric of 0 on affected Windows systems.

2nd Router Addr: By using the '-r' flag and specifying a second router address entry, the packet can contain a bogus source address and still be processed for correct gateway entries by the end host. 

https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/bin-sploits/19451.tar.gz

来源:BID
名称:578
链接:http://www.securityfocus.com/bid/578
来源:MSKB
名称:Q216141
链接:http://support.microsoft.com/default.aspx?scid=kb;%5BLN%5D;Q216141