Enrico Bassetti

**Name of the Vulnerable Software and Affected Versions** pf (affected versions not specified) **Description** The issue concerns ICMPv6 Neighbor Discovery (ND) where the ID is always 0. When pf is configured to allow ND and block incoming Echo Requests, a crafted Echo Request packet after a Neighbor Solicitation (NS) can trigger an Echo Reply. The packet must come from the same host as the NS and have a zero as identifier to match the state created by the Neighbor Discovery and allow replies to be generated. ICMPv6 packets with identifier value of zero bypass firewall rules written on the assumption that the incoming packets are going to create a state in the state table. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** FreeBSD (affected versions not specified) **Description** The issue is related to errors in the packet filter component of FreeBSD, specifically with the 'scrub fragment reassemble' rule. This can allow a remote attacker to bypass existing firewall rules by manipulating IPv6 fragmented packets. As a result, IPv6 fragments may bypass pf firewall rules and be forwarded or processed by the host. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.