Dealing with scarcity issues of Internet protocol version 4 (IPv4), internet engineering task force (IETF) developed Internet protocol version 6 (IPv6) to support the needs of IP addresses for future use of the internet, however, one challenge that must be faced while transitioning to IPv6 is in the area of security. IPv6 is a new protocol that has many new probabilities for attackers to exploit the protocol stack and one of them is through IPv6 extension headers. Mishandling of extension headers are the security nightmares for network administrators, allowing for new security threats that will cause denial of service (DoS). As a result, the mishandling of IPv6 extension Headers creates new attack vectors that could lead to DoS–which can be exploited for different purposes, such as creating covert channels, fragmentation attacks, and routing header 0 attacks. Furthermore, this paper becomes proof of concepts that even to this day our well-known network devices are still exploitable by these attack vectors.

No abstract

IPv6 extension headers (EHs) contain additional information utilized by network devices (such as routers and firewalls) to determine how to direct or process an IPv6 packet. However, the use of excessive and unknown EHs can lead to the security implications such as evasion and denial of service (DoS) of the target firewall. Study revealed that there is no permanent remediation that prevents the IPv6 EHs attack from invading the open-source firewalls by default. Using IPv6 packet manipulations technique, the attacker can evade the target network including the firewall and target host that can lead to a complete unavailability of network service. The common vulnerability scoring system (CVSS) also indicates that the base, temporal, and environment metric groups of IPv6 EHs vulnerabilities were in the critical level of severity. Quick and dirty solutions such as denying and allowing packets and IP addresses as preventive measures is still one of the effective ways of defending against the EHs packet manipulation attacks, as a temporary solution to date.