Sign-up

ID

VAR-200810-0263


CVE

CVE-2008-4404


TITLE

IPv6 implementations insecurely update Forwarding Information Base

Trust: 0.8

sources: CERT/CC: VU#472363

DESCRIPTION

The IPv6 Neighbor Discovery Protocol (NDP) implementation on IBM zSeries servers does not validate the origin of Neighbor Discovery messages, which allows remote attackers to cause a denial of service (loss of connectivity) or read private network traffic via a spoofed message that modifies the Forward Information Base (FIB), a related issue to CVE-2008-2476. A vulnerability in some implementations of the IPv6 Neighbor Discovery Protocol may allow a nearby attacker to intercept traffic or cause congested links to become overloaded. ---------------------------------------------------------------------- Did you know that a change in our assessment rating, exploit code availability, or if an updated patch is released by the vendor, is not part of this mailing-list? Click here to learn more: http://secunia.com/advisories/business_solutions/ ---------------------------------------------------------------------- TITLE: HP-UX IPv6 Neighbor Discovery Protocol Neighbor Solicitation Vulnerability SECUNIA ADVISORY ID: SA33787 VERIFY ADVISORY: http://secunia.com/advisories/33787/ CRITICAL: Less critical IMPACT: Spoofing, Exposure of sensitive information, DoS WHERE: >From local network OPERATING SYSTEM: HP-UX 11.x http://secunia.com/advisories/product/138/ DESCRIPTION: A vulnerability has been reported in HP-UX, which can be exploited by malicious people to conduct spoofing attacks, disclose potentially sensitive information, or to cause a DoS (Denial of Service). This is related to: SA32112 The vulnerability is reported in HP-UX B.11.11, B.11.23, and B.11.31 running IPv6. SOLUTION: Apply patches. HP-UX B.11.11: Install patch PHNE_37898 or subsequent. HP-UX B.11.23: Install patch PHNE_37897 or subsequent. HP-UX B.11.31: Install patch PHNE_38680 or subsequent. For more information: SA32112 2) An unspecified error exists in the handling of PPPoE discovery packets. which can be exploited to cause an out-of-bounds memory access error by sending a specially crafted PPPoE discovery packet. 3) An error exists in the handling of incoming ICMPv6 "Packet Too Big" messages, which can be exploited to shutdown the device. This is related to: SA31745 SOLUTION: Update to firmware version 7.4.1. Fixed versions: 2008-10-01 00:32:59 UTC (RELENG_7, 7.1-PRERELEASE) 2008-10-01 00:32:59 UTC (RELENG_7_0, 7.0-RELEASE-p5) 2008-10-01 00:32:59 UTC (RELENG_6, 6.4-PRERELEASE) 2008-10-01 00:32:59 UTC (RELENG_6_3, 6.3-RELEASE-p5) Patch for FreeBSD 6.3: http://security.FreeBSD.org/patches/SA-08:10/nd6-6.patch http://security.FreeBSD.org/patches/SA-08:10/nd6-6.patch.asc Patch for FreeBSD 7.0: http://security.FreeBSD.org/patches/SA-08:10/nd6-7.patch http://security.FreeBSD.org/patches/SA-08:10/nd6-7.patch.asc PROVIDED AND/OR DISCOVERED BY: The vendor credits David Miles. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c01662367 Version: 1 HPSBUX02407 SSRT080107 rev.1 - HP-UX Running IPv6, Remote Denial of Service (DoS) and Unauthorized Access NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. Release Date: 2009-02-02 Last Updated: 2009-02-02 Potential Security Impact: Remote Denial of Service (DoS) and unauthorized access Source: Hewlett-Packard Company, HP Software Security Response Team VULNERABILITY SUMMARY A potential security vulnerability has been identified with HP-UX running IPv6. This vulnerability could be exploited remotely resulting in a Denial of Service (DoS) and unauthorized access. References: CVE-2008-2476, CVE-2008-4404 SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. HP-UX B.11.11, B.11.23, B.11.31 running IPv6 BACKGROUND CVSS 2.0 Base Metrics =============================================== Reference Base Vector Base Score CVE-2008-2476 (AV:N/AC:M/Au:N/C:C/I:C/A:C) 9.3 CVE-2008-4404 (AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 =============================================== Information on CVSS is documented in HP Customer Notice: HPSN-2008-002. RESOLUTION HP has provided the following software patches to resolve the vulnerabilities. The patches are available for download from: http://itrc.hp.com HP-UX Release - B.11.11 (11i v1) Patch ID - PHNE_37898 HP-UX Release - B.11.23 (11i v2) Patch ID - PHNE_37897 HP-UX Release - B.11.31 (11i v3) Patch ID - PHNE_38680 MANUAL ACTIONS: No PRODUCT SPECIFIC INFORMATION HP-UX Software Assistant: HP-UX Software Assistant is an enhanced application that replaces HP-UX Security Patch Check. It analyzes all Security Bulletins issued by HP and lists recommended actions that may apply to a specific HP-UX system. It can also download patches and create a depot automatically. For more information see: https://www.hp.com/go/swa The following text is for use by the HP-UX Software Assistant. AFFECTED VERSIONS HP-UX B.11.11 ============= Networking.NET-KRN Networking.NET-PRG Networking.NET-RUN Networking.NET-RUN-64 OS-Core.CORE-KRN ProgSupport.C-INC Networking.NET2-KRN Networking.NMS2-KRN OS-Core.CORE2-KRN OS-Core.SYS-ADMIN Networking.NET2-KRN Networking.NMS2-KRN OS-Core.CORE2-KRN OS-Core.SYS-ADMIN action: install patch PHNE_37898 or subsequent URL: http://itrc.hp.com HP-UX B.11.23 ============= Networking.NET-PRG Networking.NET-RUN ProgSupport.C-INC Networking.NET-RUN-64 Networking.NET2-KRN Networking.NET2-RUN Networking.NMS2-KRN OS-Core.CORE2-KRN OS-Core.SYS2-ADMIN Networking.NET-RUN-64 Networking.NET2-KRN Networking.NET2-RUN Networking.NMS2-KRN OS-Core.CORE2-KRN OS-Core.SYS2-ADMIN action: install patch PHNE_37897 or subsequent URL: http://itrc.hp.com HP-UX B.11.31 ============= Networking.NET-RUN ProgSupport.C-INC Networking.NET-RUN-64 Networking.NET2-KRN Networking.NET2-RUN Networking.NMS2-KRN OS-Core.CORE2-KRN OS-Core.SYS2-ADMIN Networking.NET-RUN-64 Networking.NET2-KRN Networking.NET2-RUN Networking.NMS2-KRN OS-Core.CORE2-KRN OS-Core.SYS2-ADMIN action: install patch PHNE_38680 or subsequent URL: http://itrc.hp.com END AFFECTED VERSIONS HISTORY Version:1 (rev.1) - 2 February 2009 Initial release Third Party Security Patches: Third party security patches that are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy. Support: For further information, contact normal HP Services support channel. Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com It is strongly recommended that security related information being communicated to HP be encrypted using PGP, especially exploit information. To get the security-alert PGP key, please send an e-mail message as follows: To: security-alert@hp.com Subject: get key Subscribe: To initiate a subscription to receive future HP Security Bulletins via Email: http://h30046.www3.hp.com/driverAlertProfile.php?regioncode=NA&langcode=USENG&jumpid=in_SC-GEN__driverITRC&topiccode=ITRC On the web page: ITRC security bulletins and patch sign-up Under Step1: your ITRC security bulletins and patches - check ALL categories for which alerts are required and continue. Under Step2: your ITRC operating systems - verify your operating system selections are checked and save. To update an existing subscription: http://h30046.www3.hp.com/subSignIn.php Log in on the web page: Subscriber's choice for Business: sign-in. On the web page: Subscriber's Choice: your profile summary - use Edit Profile to update appropriate sections. To review previously published Security Bulletins visit: http://www.itrc.hp.com/service/cki/secBullArchive.do * The Software Product Category that this Security Bulletin relates to is represented by the 5th and 6th characters of the Bulletin number in the title: GN = HP General SW MA = HP Management Agents MI = Misc. 3rd Party SW MP = HP MPE/iX NS = HP NonStop Servers OV = HP OpenVMS PI = HP Printing & Imaging ST = HP Storage SW TL = HP Trusted Linux TU = HP Tru64 UNIX UX = HP-UX VV = HP VirtualVault System management and security procedures must be reviewed frequently to maintain system integrity. HP is continually reviewing and enhancing the security features of software products to provide customers with current secure solutions. "HP is broadly distributing this Security Bulletin in order to bring to the attention of users of the affected HP products the important security information contained in this Bulletin. HP recommends that all users determine the applicability of this information to their individual situations and take appropriate action. HP does not warrant that this information is necessarily accurate or complete for all user situations and, consequently, HP will not be responsible for any damages resulting from user's use or disregard of the information provided in this Bulletin. To the extent permitted by law, HP disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose, title and non-infringement." \xa9Copyright 2009 Hewlett-Packard Development Company, L.P. Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental, special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners. -----BEGIN PGP SIGNATURE----- Version: PGP 8.1 iQA/AwUBSYdFsuAfOvwtKn1ZEQK0VACeIKetdQfBDsssaZYXnerHz8AEwzEAn2iy saLPK+/sw3/02JA+b0HuzPfv =HTAW -----END PGP SIGNATURE----- . ---------------------------------------------------------------------- Do you need accurate and reliable IDS / IPS / AV detection rules? Get in-depth vulnerability details: http://secunia.com/binary_analysis/sample_analysis/ ---------------------------------------------------------------------- TITLE: Juniper Products Neighbor Discovery Protocol Neighbor Solicitation Vulnerability SECUNIA ADVISORY ID: SA32116 VERIFY ADVISORY: http://secunia.com/advisories/32116/ CRITICAL: Less critical IMPACT: Manipulation of data WHERE: >From local network OPERATING SYSTEM: Juniper IVE OS Software 1.x http://secunia.com/advisories/product/11660/ Juniper IVE OS Software 2.x http://secunia.com/advisories/product/11661/ Juniper IVE OS Software 3.x http://secunia.com/advisories/product/11662/ Juniper IVE OS Software 5.x http://secunia.com/advisories/product/6644/ Juniper IVE OS Software 4.x http://secunia.com/advisories/product/6645/ Juniper IVE OS Software 6.x http://secunia.com/advisories/product/18562/ Juniper Networks DXOS 5.x http://secunia.com/advisories/product/11183/ Juniper Networks IDP 4.x http://secunia.com/advisories/product/11181/ Juniper Networks Infranet Controller 4000 http://secunia.com/advisories/product/11167/ Juniper Networks WXC Series http://secunia.com/advisories/product/11164/ Juniper Networks WX Series http://secunia.com/advisories/product/11163/ Juniper Networks Session and Resource Control (SRC) 2.x http://secunia.com/advisories/product/19036/ Juniper Networks Secure Access 6000 SP http://secunia.com/advisories/product/13184/ Juniper Networks Secure Access 4000 (NetScreen-SA 3000 Series) http://secunia.com/advisories/product/3141/ Juniper Networks Secure Access 2000 http://secunia.com/advisories/product/11165/ Juniper Networks Infranet Controller 6000 http://secunia.com/advisories/product/11168/ Juniper Networks Secure Access 6000 (NetScreen-SA 5000 Series) http://secunia.com/advisories/product/3132/ Juniper Networks Secure Access 700 http://secunia.com/advisories/product/11166/ Juniper Networks Session and Resource Control (SRC) 1.x http://secunia.com/advisories/product/19034/ DESCRIPTION: A vulnerability has been reported in multiple Juniper Networks products, which can be exploited by malicious people to manipulate the router's neighbor cache. This can be exploited to add a fake entry to the router's neighbor cache via a neighbor solicitation request containing a spoofed IPv6 address. Successful exploitation may allow the interception or disruption of network traffic, but requires that the IPv6 nodes involved in the attack are using the same router. NOTE: The vendor has not published a publicly available advisory and has also refused to provide a list of the affected products or patches as information about vulnerabilities is provided to registered customers only. It is therefore unclear if only a subset of the products reported as vulnerable in this advisory are affected. SOLUTION: It is currently unclear whether fixes are available. PROVIDED AND/OR DISCOVERED BY: US-CERT credits David Miles. ORIGINAL ADVISORY: Juniper (login required): https://www.juniper.net/alerts/viewalert.jsp?actionBtn=Search&txtAlertNumber=PSN-2008-09-036&viewMode=view US-CERT: http://www.kb.cert.org/vuls/id/MAPG-7H2RZU OTHER REFERENCES: US-CERT VU#472363: http://www.kb.cert.org/vuls/id/472363 ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 3.15

sources: NVD: CVE-2008-4404 // CERT/CC: VU#472363 // JVNDB: JVNDB-2008-001802 // BID: 31529 // PACKETSTORM: 74623 // PACKETSTORM: 70557 // PACKETSTORM: 75476 // PACKETSTORM: 70559 // PACKETSTORM: 74584 // PACKETSTORM: 70814

AFFECTED PRODUCTS

vendor:ibmmodel:zseriesscope: - version: -

Trust: 1.4

vendor:ibmmodel:zseriesscope:eqversion:*

Trust: 1.0

vendor:apple computermodel: - scope: - version: -

Trust: 0.8

vendor:extrememodel: - scope: - version: -

Trust: 0.8

vendor:force10model: - scope: - version: -

Trust: 0.8

vendor:freebsdmodel: - scope: - version: -

Trust: 0.8

vendor:ibm zseriesmodel: - scope: - version: -

Trust: 0.8

vendor:junipermodel: - scope: - version: -

Trust: 0.8

vendor:netbsdmodel: - scope: - version: -

Trust: 0.8

vendor:openbsdmodel: - scope: - version: -

Trust: 0.8

vendor:wind rivermodel: - scope: - version: -

Trust: 0.8

vendor:hewlett packardmodel:hp-uxscope:eqversion:11.11

Trust: 0.8

vendor:hewlett packardmodel:hp-uxscope:eqversion:11.23

Trust: 0.8

vendor:hewlett packardmodel:hp-uxscope:eqversion:11.31

Trust: 0.8

vendor:necmodel:ip8800/s,/rscope: - version: -

Trust: 0.8

vendor:windmodel:river systems vxworksscope:eqversion:6.4

Trust: 0.3

vendor:windmodel:river systems vxworksscope:eqversion:5

Trust: 0.3

vendor:openbsdmodel:openbsdscope:eqversion:4.4

Trust: 0.3

vendor:openbsdmodel:openbsdscope:eqversion:4.3

Trust: 0.3

vendor:openbsdmodel:openbsdscope:eqversion:4.2

Trust: 0.3

vendor:netbsdmodel:netbsdscope:eqversion:3.0.2

Trust: 0.3

vendor:netbsdmodel:netbsdscope:eqversion:3.0.1

Trust: 0.3

vendor:netbsdmodel:currentscope: - version: -

Trust: 0.3

vendor:netbsdmodel:netbsdscope:eqversion:4.0

Trust: 0.3

vendor:netbsdmodel:3.1 rc3scope: - version: -

Trust: 0.3

vendor:netbsdmodel:netbsdscope:eqversion:3.1

Trust: 0.3

vendor:netbsdmodel:3,1 rc1scope: - version: -

Trust: 0.3

vendor:navisionmodel:financials serverscope:eqversion:3.0

Trust: 0.3

vendor:midnightbsdmodel:midnightbsdscope:eqversion:0.2.1

Trust: 0.3

vendor:midnightbsdmodel:midnightbsdscope:eqversion:0.1.1

Trust: 0.3

vendor:midnightbsdmodel:midnightbsdscope:eqversion:0.3

Trust: 0.3

vendor:midnightbsdmodel:midnightbsdscope:eqversion:0.1

Trust: 0.3

vendor:junipermodel:networks wxc seriesscope:eqversion:0

Trust: 0.3

vendor:junipermodel:networks wx seriesscope:eqversion:0

Trust: 0.3

vendor:junipermodel:networks session and resource control appliancescope:eqversion:2.0

Trust: 0.3

vendor:junipermodel:networks session and resource control appliancescope:eqversion:1.0

Trust: 0.3

vendor:junipermodel:networks secure accessscope:eqversion:7000

Trust: 0.3

vendor:junipermodel:networks secure access spscope:eqversion:60006000

Trust: 0.3

vendor:junipermodel:networks secure accessscope:eqversion:600050000

Trust: 0.3

vendor:junipermodel:networks secure accessscope:eqversion:400030000

Trust: 0.3

vendor:junipermodel:networks secure accessscope:eqversion:20000

Trust: 0.3

vendor:junipermodel:networks ive osscope:eqversion:6.0

Trust: 0.3

vendor:junipermodel:networks ive osscope:eqversion:5.0

Trust: 0.3

vendor:junipermodel:networks ive osscope:eqversion:4.0

Trust: 0.3

vendor:junipermodel:networks ive osscope:eqversion:3.0

Trust: 0.3

vendor:junipermodel:networks ive osscope:eqversion:2.0

Trust: 0.3

vendor:junipermodel:networks ive osscope:eqversion:1.0

Trust: 0.3

vendor:junipermodel:networks infranet controllerscope:eqversion:6000

Trust: 0.3

vendor:junipermodel:networks infranet controllerscope:eqversion:4000

Trust: 0.3

vendor:junipermodel:networks idpscope:eqversion:4.0

Trust: 0.3

vendor:junipermodel:networks dxosscope:eqversion:5.0

Trust: 0.3

vendor:ibmmodel:z/osscope: - version: -

Trust: 0.3

vendor:hpmodel:hp-ux b.11.31scope: - version: -

Trust: 0.3

vendor:hpmodel:hp-ux b.11.23scope: - version: -

Trust: 0.3

vendor:hpmodel:hp-ux b.11.11scope: - version: -

Trust: 0.3

vendor:hpmodel:hp-ux 11iscope:eqversion:v3

Trust: 0.3

vendor:hpmodel:hp-ux 11iscope:eqversion:v2

Trust: 0.3

vendor:hpmodel:hp-ux 11iscope:eqversion:v1

Trust: 0.3

vendor:freebsdmodel:freebsdscope:eqversion:6.0.x

Trust: 0.3

vendor:freebsdmodel:-stablescope:eqversion:6.0

Trust: 0.3

vendor:freebsdmodel:-releasescope:eqversion:6.0

Trust: 0.3

vendor:freebsdmodel:-release-p1scope:eqversion:7.1

Trust: 0.3

vendor:freebsdmodel:7.0-stablescope: - version: -

Trust: 0.3

vendor:freebsdmodel:7.0-releasescope: - version: -

Trust: 0.3

vendor:freebsdmodel:beta4scope:eqversion:7.0

Trust: 0.3

vendor:freebsdmodel:-relengscope:eqversion:7.0

Trust: 0.3

vendor:freebsdmodel:-prereleasescope:eqversion:7.0

Trust: 0.3

vendor:freebsdmodel:freebsdscope:eqversion:7.0

Trust: 0.3

vendor:freebsdmodel:-relengscope:eqversion:6.3

Trust: 0.3

vendor:freebsdmodel:freebsdscope:eqversion:6.3

Trust: 0.3

vendor:freebsdmodel:-stablescope:eqversion:6.2

Trust: 0.3

vendor:freebsdmodel:-relengscope:eqversion:6.2

Trust: 0.3

vendor:freebsdmodel:freebsdscope:eqversion:6.2

Trust: 0.3

vendor:freebsdmodel:-stablescope:eqversion:6.1

Trust: 0.3

vendor:freebsdmodel:-release-p10scope:eqversion:6.1

Trust: 0.3

vendor:freebsdmodel:-releasescope:eqversion:6.1

Trust: 0.3

vendor:freebsdmodel:-release-p5scope:eqversion:6.0

Trust: 0.3

vendor:force10model:networks ftosscope:eqversion:7.7.11

Trust: 0.3

vendor:avayamodel:proactive contactscope:eqversion:3.0

Trust: 0.3

vendor:applemodel:airport extreme base stationscope:eqversion:0

Trust: 0.3

vendor:applemodel:airport expressscope:eqversion:6.3

Trust: 0.3

vendor:applemodel:airport expressscope:eqversion:6.1

Trust: 0.3

vendor:applemodel:airport base stationscope: - version: -

Trust: 0.3

vendor:applemodel:time capsulescope:neversion:7.4.1

Trust: 0.3

vendor:applemodel:airport extreme base station with 802.11nscope:neversion:7.4.1

Trust: 0.3

vendor:applemodel:airport express base station with 802.11nscope:neversion:7.4.1

Trust: 0.3

sources: CERT/CC: VU#472363 // BID: 31529 // JVNDB: JVNDB-2008-001802 // CNNVD: CNNVD-200810-033 // NVD: CVE-2008-4404

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2008-4404
value: HIGH

Trust: 1.0

CARNEGIE MELLON: VU#472363
value: 2.70

Trust: 0.8

NVD: CVE-2008-4404
value: HIGH

Trust: 0.8

CNNVD: CNNVD-200810-033
value: CRITICAL

Trust: 0.6

nvd@nist.gov: CVE-2008-4404
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

sources: CERT/CC: VU#472363 // JVNDB: JVNDB-2008-001802 // CNNVD: CNNVD-200810-033 // NVD: CVE-2008-4404

PROBLEMTYPE DATA

problemtype:CWE-20

Trust: 1.8

sources: JVNDB: JVNDB-2008-001802 // NVD: CVE-2008-4404

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200810-033

TYPE

input validation

Trust: 0.6

sources: CNNVD: CNNVD-200810-033

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2008-001802

PATCH
title:HPSBUX02407url:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01662367
Trust: 0.8
title:Top Pageurl:http://www.ibm.com/
Trust: 0.8
title:NV08-011url:http://www.nec.co.jp/security-info/secinfo/nv08-011.html
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2008-001802

EXTERNAL IDS
db:CERT/CCid:VU#472363
Trust: 3.8
db:NVDid:CVE-2008-4404
Trust: 2.8
db:SECUNIAid:33787
Trust: 0.9
db:XFid:45601
Trust: 0.8
db:VUPENid:ADV-2009-0312
Trust: 0.8
db:JVNDBid:JVNDB-2008-001802
Trust: 0.8
db:CNNVDid:CNNVD-200810-033
Trust: 0.6
db:BIDid:31529
Trust: 0.3
db:SECUNIAid:32117
Trust: 0.2
db:SECUNIAid:32112
Trust: 0.2
db:SECUNIAid:32116
Trust: 0.2
db:PACKETSTORMid:74623
Trust: 0.1
db:PACKETSTORMid:70557
Trust: 0.1
db:SECUNIAid:34105
Trust: 0.1
db:PACKETSTORMid:75476
Trust: 0.1
db:PACKETSTORMid:70559
Trust: 0.1
db:PACKETSTORMid:74584
Trust: 0.1
db:PACKETSTORMid:70814
Trust: 0.1
sources:
            
            
            CERT/CC: VU#472363 // 
            
            
            
            BID: 31529 // 
            
            
            
            JVNDB: JVNDB-2008-001802 // 
            
            
            
            PACKETSTORM: 74623 // 
            
            
            
            PACKETSTORM: 70557 // 
            
            
            
            PACKETSTORM: 75476 // 
            
            
            
            PACKETSTORM: 70559 // 
            
            
            
            PACKETSTORM: 74584 // 
            
            
            
            PACKETSTORM: 70814 // 
            
            
            
            CNNVD: CNNVD-200810-033 // 
            
            
            
            NVD: CVE-2008-4404

REFERENCES
url:http://www.kb.cert.org/vuls/id/472363
Trust: 3.3
url:http://www.kb.cert.org/vuls/id/mapg-7h2rz8
Trust: 1.6
url:http://www.ietf.org/rfc/rfc2461.txt
Trust: 1.1
url:http://www.ietf.org/rfc/rfc3756.txt
Trust: 1.1
url:http://secunia.com/advisories/33787/
Trust: 0.9
url:http://tools.ietf.org/html/rfc4861
Trust: 0.8
url:http://tools.ietf.org/html/rfc4861#section-2.1
Trust: 0.8
url:http://www.ietf.org/rfc/rfc3177.txt
Trust: 0.8
url:http://tools.ietf.org/html/rfc3971
Trust: 0.8
url:http://docs.sun.com/app/docs/doc/817-0573/6mgc65bb6?a=view
Trust: 0.8
url:http://msdn.microsoft.com/en-us/library/ms900123.aspx
Trust: 0.8
url:http://en.wikipedia.org/wiki/forwarding_information_base#fibs_in_ingress_filtering_against_denial_of_service
Trust: 0.8
url:http://en.wikipedia.org/wiki/reverse_path_forwarding
Trust: 0.8
url:http://www.openbsd.org/faq/pf/filter.html#antispoof
Trust: 0.8
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2008-4404
Trust: 0.8
url:http://xforce.iss.net/xforce/xfdb/45601
Trust: 0.8
url:http://jvn.jp/cert/jvnvu472363/index.html
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2008-4404
Trust: 0.8
url:http://www.vupen.com/english/advisories/2009/0312
Trust: 0.8
url:http://secunia.com/advisories/secunia_security_advisories/
Trust: 0.5
url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Trust: 0.5
url:http://secunia.com/advisories/about_secunia_advisories/
Trust: 0.5
url:http://support.apple.com/kb/ht3467
Trust: 0.4
url:http://h20000.www2.hp.com/bizsupport/techsupport/document.jsp?objectid=c01662367
Trust: 0.4
url:http://www.kb.cert.org/vuls/id/mapg-7h2rzu
Trust: 0.4
url:http://www.midnightbsd.org/
Trust: 0.3
url:http://www.openbsd.org/errata43.html#005_ndp
Trust: 0.3
url:http://www.openbsd.org/errata42.html#014_ndp
Trust: 0.3
url:http://support.avaya.com/elmodocs2/security/asa-2009-059.htm
Trust: 0.3
url:http://www.openbsd.org/errata44.html#001_ndp
Trust: 0.3
url:http://secunia.com/advisories/32112/
Trust: 0.3
url:http://secunia.com/binary_analysis/sample_analysis/
Trust: 0.3
url:http://secunia.com/advisories/business_solutions/
Trust: 0.2
url:http://secunia.com/advisories/product/138/
Trust: 0.1
url:http://secunia.com/advisories/product/20024/
Trust: 0.1
url:http://www.kb.cert.org/vuls/id/mapg-7h2ry7
Trust: 0.1
url:http://secunia.com/advisories/32117/
Trust: 0.1
url:http://secunia.com/advisories/34105/
Trust: 0.1
url:http://secunia.com/advisories/try_vi/
Trust: 0.1
url:http://secunia.com/advisories/31745/
Trust: 0.1
url:http://security.freebsd.org/patches/sa-08:10/nd6-6.patch.asc
Trust: 0.1
url:http://security.freebsd.org/patches/sa-08:10/nd6-6.patch
Trust: 0.1
url:http://security.freebsd.org/advisories/freebsd-sa-08:10.nd6.asc
Trust: 0.1
url:http://security.freebsd.org/patches/sa-08:10/nd6-7.patch.asc
Trust: 0.1
url:http://secunia.com/advisories/product/6778/
Trust: 0.1
url:http://security.freebsd.org/patches/sa-08:10/nd6-7.patch
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2008-4404
Trust: 0.1
url:http://www.itrc.hp.com/service/cki/secbullarchive.do
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2008-2476
Trust: 0.1
url:http://h30046.www3.hp.com/driveralertprofile.php?regioncode=na&langcode=useng&jumpid=in_sc-gen__driveritrc&topiccode=itrc
Trust: 0.1
url:https://www.hp.com/go/swa
Trust: 0.1
url:http://itrc.hp.com
Trust: 0.1
url:http://h30046.www3.hp.com/subsignin.php
Trust: 0.1
url:http://secunia.com/advisories/product/11167/
Trust: 0.1
url:http://secunia.com/advisories/product/11181/
Trust: 0.1
url:http://secunia.com/advisories/product/18562/
Trust: 0.1
url:http://secunia.com/advisories/product/19034/
Trust: 0.1
url:http://secunia.com/advisories/product/11660/
Trust: 0.1
url:http://secunia.com/advisories/product/11165/
Trust: 0.1
url:http://secunia.com/advisories/product/11662/
Trust: 0.1
url:http://secunia.com/advisories/product/11168/
Trust: 0.1
url:http://secunia.com/advisories/product/11163/
Trust: 0.1
url:http://secunia.com/advisories/product/11166/
Trust: 0.1
url:http://secunia.com/advisories/product/13184/
Trust: 0.1
url:http://secunia.com/advisories/32116/
Trust: 0.1
url:https://www.juniper.net/alerts/viewalert.jsp?actionbtn=search&txtalertnumber=psn-2008-09-036&viewmode=view
Trust: 0.1
url:http://secunia.com/advisories/product/3132/
Trust: 0.1
url:http://secunia.com/advisories/product/11661/
Trust: 0.1
url:http://secunia.com/advisories/product/11183/
Trust: 0.1
url:http://secunia.com/advisories/product/19036/
Trust: 0.1
url:http://secunia.com/advisories/product/3141/
Trust: 0.1
url:http://secunia.com/advisories/product/11164/
Trust: 0.1
url:http://secunia.com/advisories/product/6645/
Trust: 0.1
url:http://secunia.com/advisories/product/6644/
Trust: 0.1
sources:
            
            
            CERT/CC: VU#472363 // 
            
            
            
            BID: 31529 // 
            
            
            
            JVNDB: JVNDB-2008-001802 // 
            
            
            
            PACKETSTORM: 74623 // 
            
            
            
            PACKETSTORM: 70557 // 
            
            
            
            PACKETSTORM: 75476 // 
            
            
            
            PACKETSTORM: 70559 // 
            
            
            
            PACKETSTORM: 74584 // 
            
            
            
            PACKETSTORM: 70814 // 
            
            
            
            CNNVD: CNNVD-200810-033 // 
            
            
            
            NVD: CVE-2008-4404

CREDITS
David Miles reported this issue.
Trust: 0.9
sources:
            
            
            BID: 31529 // 
            
            
            
            CNNVD: CNNVD-200810-033

SOURCES
db:CERT/CCid:VU#472363
db:BIDid:31529
db:JVNDBid:JVNDB-2008-001802
db:PACKETSTORMid:74623
db:PACKETSTORMid:70557
db:PACKETSTORMid:75476
db:PACKETSTORMid:70559
db:PACKETSTORMid:74584
db:PACKETSTORMid:70814
db:CNNVDid:CNNVD-200810-033
db:NVDid:CVE-2008-4404

LAST UPDATE DATE
2024-11-23T19:27:05.654000+00:00

SOURCES UPDATE DATE
db:CERT/CCid:VU#472363date:2009-04-27T00:00:00
db:BIDid:31529date:2015-03-19T09:41:00
db:JVNDBid:JVNDB-2008-001802date:2009-02-25T00:00:00
db:CNNVDid:CNNVD-200810-033date:2008-10-03T00:00:00
db:NVDid:CVE-2008-4404date:2024-11-21T00:51:36.110

SOURCES RELEASE DATE
db:CERT/CCid:VU#472363date:2008-10-02T00:00:00
db:BIDid:31529date:2008-10-02T00:00:00
db:JVNDBid:JVNDB-2008-001802date:2008-11-04T00:00:00
db:PACKETSTORMid:74623date:2009-02-03T17:55:30
db:PACKETSTORMid:70557date:2008-10-02T21:01:10
db:PACKETSTORMid:75476date:2009-03-06T11:40:34
db:PACKETSTORMid:70559date:2008-10-02T21:01:10
db:PACKETSTORMid:74584date:2009-02-03T20:58:57
db:PACKETSTORMid:70814date:2008-10-11T01:26:40
db:CNNVDid:CNNVD-200810-033date:2008-10-03T00:00:00
db:NVDid:CVE-2008-4404date:2008-10-03T15:07:10.837