PT-2011-1156 · Reuben Hawkins Others · Radvd

Vasiliy Kulikov · Publicado 2011-11-20 · Atualizado 2014-04-28 · CVE-2011-3603

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions radvd versions prior to 1.8.2

Description The issue is related to the router advertisement daemon (radvd) and its failure to properly handle errors in the privsep init function. This causes the radvd daemon to run as root, potentially leading to unspecified impacts. Multiple vulnerabilities in the radvd package before version 1.8.2 may allow remote exploitation, affecting the confidentiality, integrity, and availability of protected information.

Recommendations For versions prior to 1.8.2, update to version 1.8.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the radvd daemon to minimize the risk of exploitation.

Correção

Buffer Overflow

RCE

Enumeração de Fraquezas

CWE-119

CWE-20

Identificadores relacionados

BDU:2015-09423

CVE-2011-3603

Produtos afetados

Radvd

Referências · 6

• http://litech.org/radvd/CHANGES · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-3603 · Nota de Segurança
• https://access.redhat.com/security/cve/CVE-2011-3603 · Nota
• http://openwall.com/lists/oss-security/2011/10/06/3 · Nota
• http://security.gentoo.org/glsa/glsa-201111-08.xml · Nota
• https://bdu.fstec.ru/vul/2015-09423 · Nota de Segurança