Vulnerability Description
The IPv6 Neighbor Discovery Protocol (NDP) implementation in (1) FreeBSD 6.3 through 7.1, (2) OpenBSD 4.2 and 4.3, (3) NetBSD, (4) Force10 FTOS before E7.7.1.1, (5) Juniper JUNOS, and (6) Wind River VxWorks 5.x through 6.4 does not validate the origin of Neighbor Discovery messages, which allows remote attackers to cause a denial of service (loss of connectivity) or read private network traffic via a spoofed message that modifies the Forward Information Base (FIB).
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Force10 | Ftos | All versions |
| Freebsd | Freebsd | 6.3 |
| Juniper | Jnos | All versions |
| Netbsd | Netbsd | All versions |
| Openbsd | Openbsd | 4.2 |
| Windriver | Vxworks | <= 6.4 |
Related Weaknesses (CWE)
References
- ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2008-013.txt.asc
- http://secunia.com/advisories/32112Vendor Advisory
- http://secunia.com/advisories/32116
- http://secunia.com/advisories/32117Vendor Advisory
- http://secunia.com/advisories/32133
- http://secunia.com/advisories/32406
- http://security.freebsd.org/advisories/FreeBSD-SA-08:10.nd6.ascVendor Advisory
- http://securitytracker.com/id?1020968
- http://support.apple.com/kb/HT3467
- http://www.kb.cert.org/vuls/id/472363US Government Resource
- http://www.kb.cert.org/vuls/id/MAPG-7H2RY7US Government Resource
- http://www.kb.cert.org/vuls/id/MAPG-7H2S68US Government Resource
- http://www.openbsd.org/errata42.html#015_ndp
- http://www.openbsd.org/errata43.html#006_ndp
- http://www.securityfocus.com/bid/31529
FAQ
What is CVE-2008-2476?
CVE-2008-2476 is a vulnerability with a CVSS score of 9.3 (HIGH). The IPv6 Neighbor Discovery Protocol (NDP) implementation in (1) FreeBSD 6.3 through 7.1, (2) OpenBSD 4.2 and 4.3, (3) NetBSD, (4) Force10 FTOS before E7.7.1.1, (5) Juniper JUNOS, and (6) Wind River V...
How severe is CVE-2008-2476?
CVE-2008-2476 has been rated HIGH with a CVSS base score of 9.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2008-2476?
Check the references section above for vendor advisories and patch information. Affected products include: Force10 Ftos, Freebsd Freebsd, Juniper Jnos, Netbsd Netbsd, Openbsd Openbsd.