CVE-2008-2476

CVSS V2 High 9.3 CVSS V3 None
Description
The IPv6 Neighbor Discovery Protocol (NDP) implementation in (1) FreeBSD 6.3 through 7.1, (2) OpenBSD 4.2 and 4.3, (3) NetBSD, (4) Force10 FTOS before E7.7.1.1, (5) Juniper JUNOS, and (6) Wind River VxWorks 5.x through 6.4 does not validate the origin of Neighbor Discovery messages, which allows remote attackers to cause a denial of service (loss of connectivity) or read private network traffic via a spoofed message that modifies the Forward Information Base (FIB).
Overview
  • CVE ID
  • CVE-2008-2476
  • Assigner
  • cret@cert.org
  • Vulnerability Status
  • Modified
  • Published Version
  • 2008-10-03T15:07:10
  • Last Modified Date
  • 2017-09-29T01:31:11
Weakness Enumerations
CWE URL
CWE-20 http://cwe.mitre.org/data/definitions/20.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:o:force10:ftos:*:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:freebsd:freebsd:6.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:freebsd:freebsd:7.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:juniper:jnos:*:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:netbsd:netbsd:*:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:openbsd:openbsd:4.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:openbsd:openbsd:4.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:windriver:vxworks:*:*:*:*:*:*:*:* 1 OR 6.4
cpe:2.3:o:windriver:vxworks:5:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:windriver:vxworks:5.5:*:*:*:*:*:*:* 1 OR
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:N/AC:M/Au:N/C:C/I:C/A:C
  • Access Vector
  • NETWORK
  • Access Compatibility
  • MEDIUM
  • Authentication
  • NONE
  • Confidentiality Impact
  • COMPLETE
  • Integrity Impact
  • COMPLETE
  • Availability Impact
  • COMPLETE
  • Base Score
  • 9.3
  • Severity
  • HIGH
  • Exploitability Score
  • 8.6
  • Impact Score
  • 10
References
Reference URL Reference Tags
http://security.freebsd.org/advisories/FreeBSD-SA-08:10.nd6.asc Vendor Advisory
http://secunia.com/advisories/32117 Vendor Advisory
http://www.openbsd.org/errata42.html#015_ndp
http://www.openbsd.org/errata43.html#006_ndp
http://www.kb.cert.org/vuls/id/472363 US Government Resource
http://secunia.com/advisories/32112 Vendor Advisory
http://www.kb.cert.org/vuls/id/MAPG-7H2S68 US Government Resource
http://securitytracker.com/id?1020968
https://www.juniper.net/alerts/viewalert.jsp?actionBtn=Search&txtAlertNumber=PSN-2008-09-036&viewMode=view
http://www.kb.cert.org/vuls/id/MAPG-7H2RY7 US Government Resource
http://www.securityfocus.com/bid/31529
http://secunia.com/advisories/32116
http://secunia.com/advisories/32406
http://www.securitytracker.com/id?1021109
ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2008-013.txt.asc
http://www.securitytracker.com/id?1021132
http://www.vupen.com/english/advisories/2009/0633
http://support.apple.com/kb/HT3467
http://www.vupen.com/english/advisories/2008/2752
http://www.vupen.com/english/advisories/2008/2750
http://www.vupen.com/english/advisories/2008/2751
http://secunia.com/advisories/32133
https://exchange.xforce.ibmcloud.com/vulnerabilities/45601
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5670
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2008-2476
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2476
History
Created Old Value New Value Data Type Notes
2022-05-10 08:24:40 Added to TrackCVE