Multiple vendor IPv6 NDP implementation denial of service
| multiple-vendor-ndp-dos (45601) |  Medium Risk |
Description:
Multiple vendor IPv6 Neighbor Discovery Protocol (NDP) implementations are vulnerable to a denial of service, caused by a failure to validate the origin of Neighbor Discovery messages. By sending a spoofed neighbor solicitation request, a remote attacker with IPv6 connectivity to the targeted system could exploit this vulnerability to intercept traffic or add a false entry to the router's neighbor cache, which could result in a denial of service.
Platforms Affected:
- Apple, 802.11n 7.4.1
- Apple, AirPort Express Base Station
- Apple, AirPort Extreme Base Station
- Apple, Time Capsule
- Force10, FTOS
- FreeBSD, FreeBSD 6.0
- FreeBSD, FreeBSD 6.3
- FreeBSD, FreeBSD 6.4
- FreeBSD, FreeBSD 7.0
- HP, HP-UX B.11.11
- HP, HP-UX B.11.23
- HP, HP-UX B.11.31
- IBM, zSeries
- Juniper, JNOS
- NetBSD, NetBSD 3.0
- NetBSD, NetBSD 3.1
- NetBSD, NetBSD 4.0
- WindRiver, VxWorks 5.x
- WindRiver, VxWorks 6.x
Remedy:
For FreeBSD:
Refer to FreeBSD-SA-08:10.nd6 for patch, upgrade or suggested workaround information. See References.
For FTOS:
Upgrade to the latest version of FTOS (E7.7.1.1 or later), available from the Force10 Networks Web site. See References.
For other distributions:
Apply the appropriate update for your system. See References.
Consequences:
Denial of Service
References:
- Apple Web site, About the security content of Time Capsule and AirPort Base Station (802.11n*) Firmware 7.4.1 at http://support.apple.com/kb/HT3467.
- Force10 Networks Web site, Force10 Networks at http://www.force10networks.com/.
- FreeBSD Web site, The FreeBSD Project at http://www.freebsd.org/.
- FreeBSD-SA-08:10.nd6, IPv6 Neighbor Discovery Protocol routing vulnerability at http://security.freebsd.org/advisories/FreeBSD-SA-08:10.nd6.asc.
- HPSBUX02407 SSRT080107 rev.1, HP-UX Running IPv6, Remote Denial of Service (DoS) and Unauthorized Access at http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01662367.
- Juniper Networks Web site, Juniper Networks :: Login at https://www.juniper.net/siteminder/login.fcc?TYPE=33554433&REALMOID=06-3daa13b1-00fb-081a-0000-685e0000685e&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=Vx4ncNAJGSMefbakKO38xux11ByS6QdL&TARGET=$SM$https%3a%2f%2fwww.juniper.net%2falerts%2fviewalert.jsp%3fac. (Requires Login)
- NetBSD Security Advisory 2008-013 , IPv6 Neighbor Discovery Protocol at ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2008-013.txt.asc.
- US-CERT Advisory, 2008-09-30, Force10 Networks, Inc. Information for VU#472363 at http://www.kb.cert.org/vuls/id/MAPG-7H2RY7.
- Wind River Web site, Wind River Support at http://windriver.com/support/.
- ASA-2009-059: HP-UX Running IPv6 Remote Denial of Service (DoS) and Unauthorized Access (HPSBUX02407)
- BID-31529: Multiple Vendors IPv6 Neighbor Discovery Protocol Implementation Address Spoofing Vulnerability
- BID-33560: Novell GroupWise Internet Agent SMTP RCPT Command Remote Buffer Overflow Vulnerability
- CVE-2008-2476: The IPv6 Neighbor Discovery Protocol (NDP) implementation in (1) FreeBSD 6.3 through 7.1, (2) OpenBSD 4.2 and 4.3, (3) NetBSD, (4) Force10 FTOS before E7.7.1.1, (5) Juniper JUNOS, and (6) Wind River VxWorks 5.x through 6.4 does not validate the origin of Neighbor Discovery messages, which allows remote attackers to cause a denial of service (loss of connectivity) or read private network traffic via a spoofed message that modifies the Forward Information Base (FIB).
- CVE-2008-4404: The IPv6 Neighbor Discovery Protocol (NDP) implementation on IBM zSeries servers does not validate the origin of Neighbor Discovery messages, which allows remote attackers to cause a denial of service (loss of connectivity) or read private network traffic via a spoofed message that modifies the Forward Information Base (FIB), a related issue to CVE-2008-2476.
- CVE-2009-0418: The IPv6 Neighbor Discovery Protocol (NDP) implementation in HP HP-UX B.11.11, B.11.23, and B.11.31 does not validate the origin of Neighbor Discovery messages, which allows remote attackers to cause a denial of service (loss of connectivity), read private network traffic, and possibly execute arbitrary code via a spoofed message that modifies the Forward Information Base (FIB), a related issue to CVE-2008-2476.
- SA32112: FreeBSD IPv6 Neighbor Discovery Protocol Neighbor Solicitation Vulnerability
- SA32116: Juniper Products Neighbor Discovery Protocol Neighbor Solicitation Vulnerability
- SA32117: Force10 FTOS Routers IPv6 Neighbor Discovery Protocol Vulnerability
- SA32406: NetBSD IPv6 Neighbor Discovery Protocol Neighbor Solicitation Vulnerability
- SA33787: HP-UX IPv6 Neighbor Discovery Protocol Neighbor Solicitation Vulnerability
- SA34105: Apple Airport Extreme / Time Capsule Multiple Vulnerabilities
- SECTRACK ID: 1020968: FreeBSD IPv6 Neighbor Discovery Protocol Spoofing Bug Lets Remote Users Modify Routing Data in Certain Cases
- SECTRACK ID: 1021109: NetBSD IPv6 Neighbor Discovery Protocol Spoofing Bug Lets Remote Users Modify Routing Data in Certain Cases
- SECTRACK ID: 1021132: OpenBSD IPv6 Neighbor Discovery Protocol Spoofing Bug Lets Remote Users Modify Routing Data in Certain Cases
- SECTRACK ID: 1021660: HP-UX IPv6 Neighbor Discovery Protocol Spoofing Bug Lets Remote Users Modify Routing Data in Certain Cases
- US-CERT VU#472363: IPv6 implementations insecurely update Forwarding Information Base
- VUPEN/ADV-2008-2750: Force10 FTOS Routers NDP Information Disclosure Vulnerability
- VUPEN/ADV-2008-2751: Juniper Networks Products NDP Information Disclosure Vulnerability
- VUPEN/ADV-2008-2752: Wind River VxWorks NDP Information Disclosure Vulnerability
- VUPEN/ADV-2009-0312: HP-UX Security Update Fixes IPv6 Information Disclosure Vulnerability
- VUPEN/ADV-2009-0633: Apple Airport Extreme and Time Capsule Denial of Service Vulnerabilities
Reported:
Oct 02, 2008
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net