libndp: CVE-2016-3698: denial of service due to insufficient validation of source of NDP messages

Debian Bug report logs - #824545
libndp: CVE-2016-3698: denial of service due to insufficient validation of source of NDP messages

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: libndp: CVE-2016-3698: denial of service due to insufficient validation of source of NDP messages

Date: Tue, 17 May 2016 13:07:06 +0200

Source: libndp
Version: 1.4-2
Severity: important
Tags: security upstream patch fixed-upstream

Hi,

the following vulnerability was published for libndp.

CVE-2016-3698[0]:
denial of service due to insufficient validation of source of NDP messages

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2016-3698
[1] https://bugzilla.redhat.com/show_bug.cgi?id=1329366
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3698

The new upstream version 1.6 fixes the issue as well.

Regards,
Salvatore

Message #14 received at 824545-close@bugs.debian.org (full text, mbox, reply):

From: Andrew Ayer <agwa@andrewayer.name>

To: 824545-close@bugs.debian.org

Subject: Bug#824545: fixed in libndp 1.6-1

Date: Tue, 17 May 2016 19:49:04 +0000

Source: libndp
Source-Version: 1.6-1

We believe that the bug you reported is fixed in the latest version of
libndp, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 824545@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Andrew Ayer <agwa@andrewayer.name> (supplier of updated libndp package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 17 May 2016 09:20:12 -0700
Source: libndp
Binary: libndp-dbg libndp-dev libndp-tools libndp0
Architecture: source
Version: 1.6-1
Distribution: unstable
Urgency: high
Maintainer: Andrew Ayer <agwa@andrewayer.name>
Changed-By: Andrew Ayer <agwa@andrewayer.name>
Description:
 libndp-dbg - Library for Neighbor Discovery Protocol (debug symbols)
 libndp-dev - Library for Neighbor Discovery Protocol (development files)
 libndp-tools - Library for Neighbor Discovery Protocol (tools)
 libndp0    - Library for Neighbor Discovery Protocol
Closes: 781755 824545
Changes:
 libndp (1.6-1) unstable; urgency=high
 .
   * New upstream release. Fixes CVE-2016-3698. (Closes: #824545, #781755)
   * Drop kfreebsd patch, since it has been merged upstream.
   * Bump Standards-Version to 3.9.8 (no changes needed)
Checksums-Sha1:
 be09eed63dbe13b87368311bca5e72f8965c61cc 2019 libndp_1.6-1.dsc
 300e63fcf69f6239dc6c5f82770437d5ffbc2dd4 364406 libndp_1.6.orig.tar.gz
 7cb9eabd0f614ad1e62f942783940b99b3f4c09c 3120 libndp_1.6-1.debian.tar.xz
Checksums-Sha256:
 fa8ca96bc180c4c686cddb2d654d9a43cae38609e2b98ac1de35be68414b1d50 2019 libndp_1.6-1.dsc
 0c7dfa84e013bd5e569ef2c6292a6f72cfaf14f4ff77a77425e52edc33ffac0e 364406 libndp_1.6.orig.tar.gz
 831061abbb1bc6c05b9c57ab72f410ef38f9a1eec7eccdbed6c6f0f4eb448e29 3120 libndp_1.6-1.debian.tar.xz
Files:
 5d560df3f2d54395d58623fa411f7b7d 2019 net optional libndp_1.6-1.dsc
 1e54d26bcb4a4110bc3f90c5dd04f1a7 364406 net optional libndp_1.6.orig.tar.gz
 e7cdff16f4b3b200a3e386e5378aaf83 3120 net optional libndp_1.6-1.debian.tar.xz

-----BEGIN PGP SIGNATURE-----

iQIcBAEBCgAGBQJXO3MhAAoJEJ0V9ORH5MgyJKEQAIuGZuPf1zO87M8T1fWyvtHz
OvraKeQqCp2SpcNmfuN8imyktM+zEKhpynMrjuSUAHqqygteidYS+TgiVZ/SIT1T
H3f2Cnyw83mQZSBfun28jjcz3f36lIQNrQjfbkZHN+u5OMPQxt4RL9tCevaZUSBi
AfHqVj+nKYPF4wtysnUISa21nPicSFDIzNttpZUbnIpX3xJgqgkfiAxTIarYBluq
DaTd70dPvd5EmlcgJnOOkvDO0H0CodlZGT+Nwd0LljysWFvr7pkKcWQ8QHs9r8tH
2/6jnKdW/0BdjBjbVXAr9PuxKyd261Lv5Q4kDH9xg3OTBWMGfwkI85K2pq3XZket
pHPgeq94UxkK0EQU1Y0rDeVctGKEoahjUwnpqbZwJ1X1zxau+/H4MrNKwhsIYWAO
Nqis5Tq6Nmd2Ez/vnptfRWyo1u2FcXrxnQlRYz+8zirvdr25AeBORek0+Qbmk761
0a1iyrt+sEM2JcLLdP/idZ1vAdKPSkB1ScmxvmuUNsdcFE0Oc40jTxsraNip5YEd
ZD2jG/jHk42Q7WISE011Y2LZAVPyJ/HlO7tcNJX+lfMUZFkwjb8JJv0ONlT24KIk
HIWCOQfTKEdhrxjbicZNTSiOjGbRoXe519KJIkgAeDBwsXapEp0u9zSWKhzChCjM
6ZZjkeOcRtkXAZMciB0H
=c3b/
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.