CVE-2008-2476

Published: Oct 3, 2008Modified: Apr 23, 2026

9.3

Vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability: 8.6 / Impact: 10.0

Source: NVD

Description

The IPv6 Neighbor Discovery Protocol (NDP) implementation in (1) FreeBSD 6.3 through 7.1, (2) OpenBSD 4.2 and 4.3, (3) NetBSD, (4) Force10 FTOS before E7.7.1.1, (5) Juniper JUNOS, and (6) Wind River VxWorks 5.x through 6.4 does not validate the origin of Neighbor Discovery messages, which allows remote attackers to cause a denial of service (loss of connectivity) or read private network traffic via a spoofed message that modifies the Forward Information Base (FIB).

Affected (10)

Products: Force10: Ftos · Freebsd: Freebsd · Juniper: Jnos · +3 more

Show all products

Force10: Ftos · Freebsd: Freebsd · Juniper: Jnos · Netbsd: Netbsd · Openbsd: Openbsd · Windriver: Vxworks

1 product

1 product

1 product

1 product

1 product

1 product

Configuration A

10 vulnerable

Vulnerable Software	Affected Versions
Force10 Ftos	All versions
Freebsd Freebsd	Version 6.3
Freebsd Freebsd	Version 7.1
Juniper Jnos	All versions
Netbsd Netbsd	All versions
Openbsd Openbsd	Version 4.2
Openbsd Openbsd	Version 4.3
Windriver Vxworks	Up to 6.4
Windriver Vxworks	Version 5.5
Windriver Vxworks	Version 5

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (48)

ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2008-013.txt.asc (unsafe URL)

Source: cret@cert.org

http://secunia.com/advisories/32112

Source: cret@cert.org

Vendor Advisory

http://secunia.com/advisories/32116

Source: cret@cert.org

http://secunia.com/advisories/32117

Source: cret@cert.org

Vendor Advisory

http://secunia.com/advisories/32133

Source: cret@cert.org

http://secunia.com/advisories/32406

Source: cret@cert.org

http://security.freebsd.org/advisories/FreeBSD-SA-08:10.nd6.asc

Source: cret@cert.org

Vendor Advisory

http://securitytracker.com/id?1020968

Source: cret@cert.org

http://support.apple.com/kb/HT3467

Source: cret@cert.org

http://www.kb.cert.org/vuls/id/472363

Source: cret@cert.org

US Government Resource

http://www.kb.cert.org/vuls/id/MAPG-7H2RY7

Source: cret@cert.org

US Government Resource

http://www.kb.cert.org/vuls/id/MAPG-7H2S68

Source: cret@cert.org

US Government Resource

http://www.openbsd.org/errata42.html#015_ndp

Source: cret@cert.org

http://www.openbsd.org/errata43.html#006_ndp

Source: cret@cert.org

http://www.securityfocus.com/bid/31529

Source: cret@cert.org

http://www.securitytracker.com/id?1021109

Source: cret@cert.org

http://www.securitytracker.com/id?1021132

Source: cret@cert.org

http://www.vupen.com/english/advisories/2008/2750

Source: cret@cert.org

http://www.vupen.com/english/advisories/2008/2751

Source: cret@cert.org

http://www.vupen.com/english/advisories/2008/2752

Source: cret@cert.org

http://www.vupen.com/english/advisories/2009/0633

Source: cret@cert.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/45601

Source: cret@cert.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5670

Source: cret@cert.org

https://www.juniper.net/alerts/viewalert.jsp?actionBtn=Search&txtAlertNumber=PSN-2008-09-036&viewMode=view

Source: cret@cert.org

ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2008-013.txt.asc (unsafe URL)

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/32112

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/32116

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/32117

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/32133

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/32406

Source: af854a3a-2127-422b-91ae-364da2661108

http://security.freebsd.org/advisories/FreeBSD-SA-08:10.nd6.asc

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://securitytracker.com/id?1020968

Source: af854a3a-2127-422b-91ae-364da2661108

http://support.apple.com/kb/HT3467

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.kb.cert.org/vuls/id/472363

Source: af854a3a-2127-422b-91ae-364da2661108

US Government Resource

http://www.kb.cert.org/vuls/id/MAPG-7H2RY7

Source: af854a3a-2127-422b-91ae-364da2661108

US Government Resource

http://www.kb.cert.org/vuls/id/MAPG-7H2S68

Source: af854a3a-2127-422b-91ae-364da2661108

US Government Resource

http://www.openbsd.org/errata42.html#015_ndp

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openbsd.org/errata43.html#006_ndp

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/31529

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securitytracker.com/id?1021109

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securitytracker.com/id?1021132

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2008/2750

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2008/2751

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2008/2752

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2009/0633

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/45601

Source: af854a3a-2127-422b-91ae-364da2661108

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5670

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.juniper.net/alerts/viewalert.jsp?actionBtn=Search&txtAlertNumber=PSN-2008-09-036&viewMode=view

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.