National Cyber Awareness System

Vulnerability Summary for CVE-2008-2476

Overview

The IPv6 Neighbor Discovery Protocol (NDP) implementation in (1) FreeBSD 6.3 through 7.1, (2) OpenBSD 4.2 and 4.3, (3) NetBSD, (4) Force10 FTOS before E7.7.1.1, (5) Juniper JUNOS, and (6) Wind River VxWorks 5.x through 6.4 does not validate the origin of Neighbor Discovery messages, which allows remote attackers to cause a denial of service (loss of connectivity) or read private network traffic via a spoofed message that modifies the Forward Information Base (FIB).

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

Vendor Statements (disclaimer)

Official Statement from Red Hat (01/01/1900)

Not vulnerable. This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 2.1, 3, 4, 5 or Red Hat Enterprise MRG.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

US-CERT Vulnerability Note: VU#MAPG-7H2S68

Name: http://www.kb.cert.org/vuls/id/MAPG-7H2S68

Hyperlink:http://www.kb.cert.org/vuls/id/MAPG-7H2S68

US-CERT Vulnerability Note: VU#MAPG-7H2RY7

Name: http://www.kb.cert.org/vuls/id/MAPG-7H2RY7

Hyperlink:http://www.kb.cert.org/vuls/id/MAPG-7H2RY7

US-CERT Vulnerability Note: VU#472363

Name: VU#472363

Hyperlink:http://www.kb.cert.org/vuls/id/472363

External Source: MISC

Name: https://www.juniper.net/alerts/viewalert.jsp?actionBtn=Search&txtAlertNumber=PSN-2008-09-036&viewMode=view

Hyperlink:https://www.juniper.net/alerts/viewalert.jsp?actionBtn=Search&txtAlertNumber=PSN-2008-09-036&viewMode=view

External Source: XF

Name: multiple-vendors-ndp-dos(45601)

Hyperlink:http://xforce.iss.net/xforce/xfdb/45601

External Source: VUPEN

Name: ADV-2009-0633

Hyperlink:http://www.vupen.com/english/advisories/2009/0633

External Source: VUPEN

Name: ADV-2008-2752

Hyperlink:http://www.vupen.com/english/advisories/2008/2752

External Source: VUPEN

Name: ADV-2008-2751

Hyperlink:http://www.vupen.com/english/advisories/2008/2751

External Source: VUPEN

Name: ADV-2008-2750

Hyperlink:http://www.vupen.com/english/advisories/2008/2750

External Source: SECTRACK

Name: 1021132

Hyperlink:http://www.securitytracker.com/id?1021132

External Source: SECTRACK

Name: 1021109

Hyperlink:http://www.securitytracker.com/id?1021109

External Source: BID

Name: 31529

Hyperlink:http://www.securityfocus.com/bid/31529

External Source: OPENBSD

Name: [4.3] 006: SECURITY FIX: October 2, 2008

Hyperlink:http://www.openbsd.org/errata43.html#006_ndp

External Source: OPENBSD

Name: [4.2] 015: SECURITY FIX: October 2, 2008

Hyperlink:http://www.openbsd.org/errata42.html#015_ndp

External Source: CONFIRM

Name: http://support.apple.com/kb/HT3467

Hyperlink:http://support.apple.com/kb/HT3467

External Source: SECTRACK

Name: 1020968

Hyperlink:http://securitytracker.com/id?1020968

External Source: FREEBSD

Name: FreeBSD-SA-08:10

Type: Advisory

Hyperlink:http://security.freebsd.org/advisories/FreeBSD-SA-08:10.nd6.asc

External Source: SECUNIA

Name: 32406

Hyperlink:http://secunia.com/advisories/32406

External Source: SECUNIA

Name: 32133

Hyperlink:http://secunia.com/advisories/32133

External Source: SECUNIA

Name: 32117

Type: Advisory

Hyperlink:http://secunia.com/advisories/32117

External Source: SECUNIA

Name: 32116

Hyperlink:http://secunia.com/advisories/32116

External Source: SECUNIA

Name: 32112

Type: Advisory

Hyperlink:http://secunia.com/advisories/32112

External Source: OVAL

Name: oval:org.mitre.oval:def:5670

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:5670

External Source: NETBSD

Name: NetBSD-SA2008-013

Hyperlink:ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2008-013.txt.asc

References to Check Content

Identifier:oval:org.mitre.oval:def:5670

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:5670