CVE-2008-2476 The IPv6 Neighbor Discovery Protocol (NDP) implementation in (1) FreeBSD 6.3 through 7.1, (2) OpenBSD 4.2 and 4.3, (3) NetBSD, (4) Force10 FTOS before E7.7.1.1, (5) Juniper JUNOS, and (6) Wind River V...
HighCVSS 9.3
EPSS 7.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The IPv6 Neighbor Discovery Protocol (NDP) implementation in (1) FreeBSD 6.3 through 7.1, (2) OpenBSD 4.2 and 4.3, (3) NetBSD, (4) Force10 FTOS before E7.7.1.1, (5) Juniper JUNOS, and (6) Wind River VxWorks 5.x through 6.4 does not validate the origin of Neighbor Discovery messages, which allows remote attackers to cause a denial of service (loss of connectivity) or read private network traffic via a spoofed message that modifies the Forward Information Base (FIB).
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| force10 ftos | All versions | No fix listed |
| freebsd | = 6.3 | No fix listed |
| freebsd | = 7.1 | No fix listed |
| juniper jnos | All versions | No fix listed |
| netbsd | All versions | No fix listed |
| OpenBSD | = 4.2 | No fix listed |
| OpenBSD | = 4.3 | No fix listed |
| windriver vxworks | <= 6.4 | No fix listed |
| windriver vxworks | = 5 | No fix listed |
| windriver vxworks | = 5.5 | No fix listed |
References
- 32112 third-party-advisory vendor-advisory
- 32116 third-party-advisory
- 32117 third-party-advisory vendor-advisory
- 32133 third-party-advisory
- 32406 third-party-advisory
- FreeBSD-SA-08:10 vendor-advisory
- 1020968 vdb-entry
- support.apple.com
- VU#472363 third-party-advisory us-government-resource
- www.kb.cert.org us-government-resource
- www.kb.cert.org us-government-resource
- [4.2] 015: SECURITY FIX: October 2, 2008 vendor-advisory
- [4.3] 006: SECURITY FIX: October 2, 2008 vendor-advisory
- 31529 vdb-entry
- 1021109 vdb-entry
- 1021132 vdb-entry
- ADV-2008-2750 vdb-entry
- ADV-2008-2751 vdb-entry
- ADV-2008-2752 vdb-entry
- ADV-2009-0633 vdb-entry
- multiple-vendors-ndp-dos(45601) vdb-entry
- oval:org.mitre.oval:def:5670 signature vdb-entry
- www.juniper.net