ID

VAR-200809-0176

CVE

CVE-2008-3530

TITLE

IPv6 implementations insecurely update Forwarding Information Base

DESCRIPTION

sys/netinet6/icmp6.c in the kernel in FreeBSD 6.3 through 7.1, NetBSD 3.0 through 4.0, and possibly other operating systems does not properly check the proposed new MTU in an ICMPv6 Packet Too Big Message, which allows remote attackers to cause a denial of service (panic) via a crafted Packet Too Big Message. A vulnerability in some implementations of the IPv6 Neighbor Discovery Protocol may allow a nearby attacker to intercept traffic or cause congested links to become overloaded. FreeBSD is prone to a remote denial-of-service vulnerability. Remote attackers can exploit this issue to cause the kernel's TCP stack to panic, denying service to legitimate users. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-08:09.icmp6 Security Advisory The FreeBSD Project Topic: Remote kernel panics on IPv6 connections Category: core Module: sys_netinet6 Announced: 2008-09-03 Credits: Tom Parker, Bjoern A. Zeeb Affects: All supported versions of FreeBSD. Corrected: 2008-09-03 19:09:47 UTC (RELENG_7, 7.1-PRERELEASE) 2008-09-03 19:09:47 UTC (RELENG_7_0, 7.0-RELEASE-p4) 2008-09-03 19:09:47 UTC (RELENG_6, 6.4-PRERELEASE) 2008-09-03 19:09:47 UTC (RELENG_6_3, 6.3-RELEASE-p4) CVE Name: CVE-2008-3530 For general information regarding FreeBSD Security Advisories, including descriptions of the fields above, security branches, and the following sections, please visit <URL:http://security.FreeBSD.org/>. I. Background IPv6 nodes use ICMPv6 amongst other things to report errors encountered while processing packets. The 'Packet Too Big Message' is sent in case a node cannot forward a packet because the size of the packet is larger than the MTU of next-hop link. II. III. Workaround Systems without INET6 / IPv6 support are not vulnerable and neither are systems which do not listen on any IPv6 TCP sockets and have no active IPv6 connections. Filter ICMPv6 'Packet Too Big Messages' using a firewall, but this will at the same time break PMTU support for IPv6 connections. V. Solution Perform one of the following: 1) Upgrade your vulnerable system to 6-STABLE or 7-STABLE, or to the RELENG_6_3 or RELENG_7_0 security branch dated after the correction date. 2) To patch your present system: The following patches have been verified to apply to FreeBSD 6.3 and FreeBSD 7.0 systems. a) Download the relevant patch from the location below, and verify the detached PGP signature using your PGP utility. # fetch http://security.FreeBSD.org/patches/SA-08:09/icmp6.patch # fetch http://security.FreeBSD.org/patches/SA-08:09/icmp6.patch.asc b) Apply the patch. # cd /usr/src # patch < /path/to/patch c) Recompile your kernel as described in <URL:http://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the system. VI. Correction details The following list contains the revision numbers of each file that was corrected in FreeBSD. Branch Revision Path - ------------------------------------------------------------------------- RELENG_6 src/sys/netinet6/icmp6.c 1.62.2.11 RELENG_6_3 src/UPDATING 1.416.2.37.2.9 src/sys/conf/newvers.sh 1.69.2.15.2.8 src/sys/netinet6/icmp6.c 1.62.2.9.2.1 RELENG_7 src/sys/netinet6/icmp6.c 1.80.2.7 RELENG_7_0 src/UPDATING 1.507.2.3.2.8 src/sys/conf/newvers.sh 1.72.2.5.2.8 src/sys/netinet6/icmp6.c 1.80.4.1 - ------------------------------------------------------------------------- VII. References http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3530 The latest revision of this advisory is available at http://security.FreeBSD.org/advisories/FreeBSD-SA-08:09.icmp6.asc -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (FreeBSD) iD8DBQFIvu2hFdaIBMps37IRAjxxAJwIIXP+ALAZkvG5m687PC+92BtXTwCfUZdS AvvrO0r+UAa6bn1H9mFf9So= =MBB1 -----END PGP SIGNATURE----- . ---------------------------------------------------------------------- Do you need accurate and reliable IDS / IPS / AV detection rules? Get in-depth vulnerability details: http://secunia.com/binary_analysis/sample_analysis/ ---------------------------------------------------------------------- TITLE: Juniper Products Neighbor Discovery Protocol Neighbor Solicitation Vulnerability SECUNIA ADVISORY ID: SA32116 VERIFY ADVISORY: http://secunia.com/advisories/32116/ CRITICAL: Less critical IMPACT: Manipulation of data WHERE: >From local network OPERATING SYSTEM: Juniper IVE OS Software 1.x http://secunia.com/advisories/product/11660/ Juniper IVE OS Software 2.x http://secunia.com/advisories/product/11661/ Juniper IVE OS Software 3.x http://secunia.com/advisories/product/11662/ Juniper IVE OS Software 5.x http://secunia.com/advisories/product/6644/ Juniper IVE OS Software 4.x http://secunia.com/advisories/product/6645/ Juniper IVE OS Software 6.x http://secunia.com/advisories/product/18562/ Juniper Networks DXOS 5.x http://secunia.com/advisories/product/11183/ Juniper Networks IDP 4.x http://secunia.com/advisories/product/11181/ Juniper Networks Infranet Controller 4000 http://secunia.com/advisories/product/11167/ Juniper Networks WXC Series http://secunia.com/advisories/product/11164/ Juniper Networks WX Series http://secunia.com/advisories/product/11163/ Juniper Networks Session and Resource Control (SRC) 2.x http://secunia.com/advisories/product/19036/ Juniper Networks Secure Access 6000 SP http://secunia.com/advisories/product/13184/ Juniper Networks Secure Access 4000 (NetScreen-SA 3000 Series) http://secunia.com/advisories/product/3141/ Juniper Networks Secure Access 2000 http://secunia.com/advisories/product/11165/ Juniper Networks Infranet Controller 6000 http://secunia.com/advisories/product/11168/ Juniper Networks Secure Access 6000 (NetScreen-SA 5000 Series) http://secunia.com/advisories/product/3132/ Juniper Networks Secure Access 700 http://secunia.com/advisories/product/11166/ Juniper Networks Session and Resource Control (SRC) 1.x http://secunia.com/advisories/product/19034/ DESCRIPTION: A vulnerability has been reported in multiple Juniper Networks products, which can be exploited by malicious people to manipulate the router's neighbor cache. This can be exploited to add a fake entry to the router's neighbor cache via a neighbor solicitation request containing a spoofed IPv6 address. Successful exploitation may allow the interception or disruption of network traffic, but requires that the IPv6 nodes involved in the attack are using the same router. NOTE: The vendor has not published a publicly available advisory and has also refused to provide a list of the affected products or patches as information about vulnerabilities is provided to registered customers only. It is therefore unclear if only a subset of the products reported as vulnerable in this advisory are affected. SOLUTION: It is currently unclear whether fixes are available. PROVIDED AND/OR DISCOVERED BY: US-CERT credits David Miles. ORIGINAL ADVISORY: Juniper (login required): https://www.juniper.net/alerts/viewalert.jsp?actionBtn=Search&txtAlertNumber=PSN-2008-09-036&viewMode=view US-CERT: http://www.kb.cert.org/vuls/id/MAPG-7H2RZU OTHER REFERENCES: US-CERT VU#472363: http://www.kb.cert.org/vuls/id/472363 ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

input validation

CONFIGURATIONS

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Tom Parker※ tom@rooted.net※Bjoern A. Zeeb※ bz@zabbadoz.net

SOURCES

LAST UPDATE DATE

2024-11-23T20:19:03.024000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE