Vulnerability Details : CVE-2008-2476
The IPv6 Neighbor Discovery Protocol (NDP) implementation in (1) FreeBSD 6.3 through 7.1, (2) OpenBSD 4.2 and 4.3, (3) NetBSD, (4) Force10 FTOS before E7.7.1.1, (5) Juniper JUNOS, and (6) Wind River VxWorks 5.x through 6.4 does not validate the origin of Neighbor Discovery messages, which allows remote attackers to cause a denial of service (loss of connectivity) or read private network traffic via a spoofed message that modifies the Forward Information Base (FIB).
Vulnerability category: Denial of service
Products affected by CVE-2008-2476
- cpe:2.3:o:freebsd:freebsd:6.3:*:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:7.1:*:*:*:*:*:*:*
- cpe:2.3:o:netbsd:netbsd:*:*:*:*:*:*:*:*
- cpe:2.3:o:windriver:vxworks:*:*:*:*:*:*:*:*
- cpe:2.3:o:windriver:vxworks:5.5:*:*:*:*:*:*:*
- cpe:2.3:o:windriver:vxworks:5:*:*:*:*:*:*:*
- cpe:2.3:o:openbsd:openbsd:4.2:*:*:*:*:*:*:*
- cpe:2.3:o:openbsd:openbsd:4.3:*:*:*:*:*:*:*
- cpe:2.3:o:juniper:jnos:*:*:*:*:*:*:*:*
- cpe:2.3:o:force10:ftos:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2008-2476
9.53%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 92 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2008-2476
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
9.3
|
HIGH | AV:N/AC:M/Au:N/C:C/I:C/A:C |
8.6
|
10.0
|
NIST |
CWE ids for CVE-2008-2476
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
Vendor statements for CVE-2008-2476
-
Red Hat 2017-09-28Not vulnerable. This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 2.1, 3, 4, 5 or Red Hat Enterprise MRG.
References for CVE-2008-2476
-
http://www.vupen.com/english/advisories/2008/2751
-
http://www.kb.cert.org/vuls/id/MAPG-7H2S68
US Government Resource
-
http://support.apple.com/kb/HT3467
-
http://secunia.com/advisories/32116
-
http://www.vupen.com/english/advisories/2008/2750
-
http://www.openbsd.org/errata42.html#015_ndp
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/45601
-
http://www.securitytracker.com/id?1021109
-
http://security.freebsd.org/advisories/FreeBSD-SA-08:10.nd6.asc
Vendor Advisory
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5670
-
http://www.vupen.com/english/advisories/2009/0633
-
http://securitytracker.com/id?1020968
-
ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2008-013.txt.asc
-
https://www.juniper.net/alerts/viewalert.jsp?actionBtn=Search&txtAlertNumber=PSN-2008-09-036&viewMode=view
-
http://www.kb.cert.org/vuls/id/MAPG-7H2RY7
US Government Resource
-
http://secunia.com/advisories/32117
Vendor Advisory
-
http://www.securitytracker.com/id?1021132
-
http://www.securityfocus.com/bid/31529
-
http://www.kb.cert.org/vuls/id/472363
US Government Resource
-
http://www.vupen.com/english/advisories/2008/2752
-
http://secunia.com/advisories/32112
Vendor Advisory
-
http://secunia.com/advisories/32406
-
http://www.openbsd.org/errata43.html#006_ndp
-
http://secunia.com/advisories/32133
Jump to