PT-2011-1156 · Reuben Hawkins Others · Radvd

Vasiliy Kulikov · Published 2011-11-20 · Updated 2014-04-28 · CVE-2011-3603

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions radvd versions prior to 1.8.2

Description The issue is related to the router advertisement daemon (radvd) and its failure to properly handle errors in the privsep init function. This causes the radvd daemon to run as root, potentially leading to unspecified impacts. Multiple vulnerabilities in the radvd package before version 1.8.2 may allow remote exploitation, affecting the confidentiality, integrity, and availability of protected information.

Recommendations For versions prior to 1.8.2, update to version 1.8.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the radvd daemon to minimize the risk of exploitation.

Fix

Buffer Overflow

RCE

Weakness Enumeration

CWE-119

CWE-20

Related Identifiers

BDU:2015-09423

CVE-2011-3603

Affected Products

Radvd

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2011-3603 · Security Note
• https://bdu.fstec.ru/vul/2015-09423 · Security Note
• http://litech.org/radvd/CHANGES · Note
• https://access.redhat.com/security/cve/CVE-2011-3603 · Note
• http://openwall.com/lists/oss-security/2011/10/06/3 · Note
• http://security.gentoo.org/glsa/glsa-201111-08.xml · Note