SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   OS (UNIX)  >   OpenBSD Kernel Vendors:   OpenBSD
OpenBSD IPv6 Neighbor Discovery Protocol Spoofing Bug Lets Remote Users Modify Routing Data in Certain Cases
SecurityTracker Alert ID:  1021132
SecurityTracker URL:  http://securitytracker.com/id/1021132
CVE Reference:   CVE-2008-2476   (Links to External Site)
Date:  Nov 3 2008
Impact:   Disclosure of system information, Disclosure of user information, Modification of system information
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 4.2, 4.3, 4.4
Description:   A vulnerability was reported in the OpenBSD IPv6 Neighbor Discovery Protocol. A remote user can modify routing data for a target router in certain cases.

A remote user on a physical network of an IPv6 router can spoof Neighbor Discovery messages to update routing information for a target router on a different physical network adjacent to the IPv6 router. The remote user can exploit this to deny service or access network traffic from the target router.

David Miles reported this vulnerability.

Impact:   A remote user can modify routing data for a target router in certain cases to deny service or redirect and access network traffic.
Solution:   The vendor has issued patches:

ftp://ftp.openbsd.org/pub/OpenBSD/patches/4.4/common/001_ndp.patch
ftp://ftp.openbsd.org/pub/OpenBSD/patches/4.3/common/006_ndp.patch
ftp://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/015_ndp.patch

Vendor URL:  www.openbsd.org/ (Links to External Site)
Cause:   Authentication error

Message History:   None.


 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2020, SecurityGlobal.net LLC