Published: 13/06/2016 Updated: 12/02/2023

CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6

CVSS v3 Base Score: 8.1 | Impact Score: 5.9 | Exploitability Score: 2.2

VMScore: 605

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

libndp prior to 1.6, as used in NetworkManager, does not properly validate the origin of Neighbor Discovery Protocol (NDP) messages, which allows remote malicious users to conduct man-in-the-middle attacks or cause a denial of service (network connectivity disruption) by advertising a node as a router from a non-local network.

Vulnerable Product	Search on Vulmon	Subscribe to Product
redhat enterprise linux desktop 7.0
redhat enterprise linux server aus 7.2
redhat enterprise linux workstation 7.0
redhat enterprise linux server 7.0
redhat enterprise linux hpc node 7.0
redhat enterprise linux server eus 7.2
redhat enterprise linux hpc node eus 7.2
libndp libndp
debian debian linux 8.0
canonical ubuntu linux 16.04
canonical ubuntu linux 15.10

Debian Bug report logs - #824545 libndp: CVE-2016-3698: denial of service due to insufficient validation of source of NDP messages Package: src:libndp; Maintainer for src:libndp is Andrew Ayer <agwa@andrewayername>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Tue, 17 May 2016 11:09:01 UTC Severity: i ...

libndp could be tricked into accepting an NDP message from outside the local network ...

Julien Bernard discovered that libndp, a library for the IPv6 Neighbor Discovery Protocol, does not properly perform input and origin checks during the reception of a NDP message An attacker in a non-local network could use this flaw to advertise a node as a router, and cause a denial of service attack, or act as a man-in-the-middle For the stabl ...

CWE-284 https://github.com/jpirko/libndp/commit/2af9a55b38b55abbf05fd116ec097d4029115839 https://rhn.redhat.com/errata/RHSA-2016-1086.html http://www.openwall.com/lists/oss-security/2016/05/17/9 http://www.debian.org/security/2016/dsa-3581 https://github.com/jpirko/libndp/commit/a4892df306e0532487f1634ba6d4c6d4bb381c7f http://www.ubuntu.com/usn/USN-2980-1 http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=824545 https://usn.ubuntu.com/2980-1/https://nvd.nist.gov

CVE-2016-3698

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect