Vulnerability Details : CVE-2008-2476
The IPv6 Neighbor Discovery Protocol (NDP) implementation in (1) FreeBSD 6.3 through 7.1, (2) OpenBSD 4.2 and 4.3, (3) NetBSD, (4) Force10 FTOS before E7.7.1.1, (5) Juniper JUNOS, and (6) Wind River VxWorks 5.x through 6.4 does not validate the origin of Neighbor Discovery messages, which allows remote attackers to cause a denial of service (loss of connectivity) or read private network traffic via a spoofed message that modifies the Forward Information Base (FIB).
Vulnerability category: Input validationDenial of service
Exploit prediction scoring system (EPSS) score for CVE-2008-2476
Probability of exploitation activity in the next 30 days: 2.70%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 89 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2008-2476
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
9.3
|
HIGH | AV:N/AC:M/Au:N/C:C/I:C/A:C |
8.6
|
10.0
|
NIST |
CWE ids for CVE-2008-2476
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
Vendor statements for CVE-2008-2476
-
Red Hat 2017-09-28Not vulnerable. This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 2.1, 3, 4, 5 or Red Hat Enterprise MRG.
-
http://www.vupen.com/english/advisories/2008/2751
-
http://www.kb.cert.org/vuls/id/MAPG-7H2S68
US Government Resource
- http://support.apple.com/kb/HT3467
-
http://www.vupen.com/english/advisories/2008/2750
-
http://www.openbsd.org/errata42.html#015_ndp
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/45601
-
http://www.securitytracker.com/id?1021109
-
http://security.freebsd.org/advisories/FreeBSD-SA-08:10.nd6.asc
Vendor Advisory
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5670
- http://www.vupen.com/english/advisories/2009/0633
-
http://securitytracker.com/id?1020968
-
ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2008-013.txt.asc
-
https://www.juniper.net/alerts/viewalert.jsp?actionBtn=Search&txtAlertNumber=PSN-2008-09-036&viewMode=view
-
http://www.kb.cert.org/vuls/id/MAPG-7H2RY7
US Government Resource
-
http://www.securitytracker.com/id?1021132
-
http://www.securityfocus.com/bid/31529
-
http://www.kb.cert.org/vuls/id/472363
US Government Resource
-
http://www.vupen.com/english/advisories/2008/2752
-
http://www.openbsd.org/errata43.html#006_ndp
- cpe:2.3:o:freebsd:freebsd:6.3:*:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:7.1:*:*:*:*:*:*:*
- cpe:2.3:o:netbsd:netbsd:*:*:*:*:*:*:*:*
- cpe:2.3:o:windriver:vxworks:*:*:*:*:*:*:*:*
- cpe:2.3:o:windriver:vxworks:5.5:*:*:*:*:*:*:*
- cpe:2.3:o:windriver:vxworks:5:*:*:*:*:*:*:*
- cpe:2.3:o:openbsd:openbsd:4.2:*:*:*:*:*:*:*
- cpe:2.3:o:openbsd:openbsd:4.3:*:*:*:*:*:*:*
- cpe:2.3:o:juniper:jnos:*:*:*:*:*:*:*:*
- cpe:2.3:o:force10:ftos:*:*:*:*:*:*:*:*