The process_rs function in the router advertisement daemon (radvd) before 1.8.2, when UnicastOnly is enabled, allows remote attackers to cause a denial of service (temporary service hang) via a large number of ND_ROUTER_SOLICIT requests.

The remote Redhat Enterprise Linux 4 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - radvd: numerous buffer overread flaws in process_ra() may lead to crash (CVE-2011-3604)

  - radvd: temporary denial of service flaw in process_rs() (CVE-2011-3605)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - radvd: numerous buffer overread flaws in process_ra() may lead to crash (CVE-2011-3604)

  - radvd: temporary denial of service flaw in process_rs() (CVE-2011-3605)

  - Directory traversal vulnerability in device-linux.c in the router advertisement daemon (radvd) before     1.8.2 allows local users to overwrite arbitrary files, and remote attackers to overwrite certain files,     via a .. (dot dot) in an interface name. NOTE: this can be leveraged with a symlink to overwrite arbitrary     files. (CVE-2011-3602)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - radvd: numerous buffer overread flaws in process_ra() may lead to crash (CVE-2011-3604)

  - radvd: temporary denial of service flaw in process_rs() (CVE-2011-3605)

  - Directory traversal vulnerability in device-linux.c in the router advertisement daemon (radvd) before     1.8.2 allows local users to overwrite arbitrary files, and remote attackers to overwrite certain files,     via a .. (dot dot) in an interface name. NOTE: this can be leveraged with a symlink to overwrite arbitrary     files. (CVE-2011-3602)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This update of radvd fixes the following security flaws :

  - arbitrary file overwrite flaw through unsanitized     interface names (CVE-2011-3602),

  - missing return value checks in privsep_init() which     could cause radvd to keep running with root privileges     (CVE-2011-3603),

  - buffer overread flaws in the process_ra() function     (CVE-2011-3604),

  - temporary denial of service flaw triggered with a flood     of ND_ROUTER_SOLICIT (CVE-2011-3605)

This update of radvd fixes multiple buffer overread flaws in the process_ra() function that could have potentially lead to crashes (CVE-2011-3604). Additionally, a temporary Denial of Service flaw that could be triggered with a flood of ND_ROUTER_SOLICIT has been fixed.
(CVE-2011-3605)

This update of radvd fixes the following security flaws :

  - arbitrary file overwrite flaw through unsanitized     interface names (CVE-2011-3602),

  - missing return value checks in privsep_init() which     could cause radvd to keep running with root privileges     (CVE-2011-3603),

  - buffer overread flaws in the process_ra() function     (CVE-2011-3604),

  - temporary denial of service flaw triggered by a flood of     ND_ROUTER_SOLICIT (CVE-2011-3605)

The remote host is affected by the vulnerability described in GLSA-201111-08 (radvd: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in radvd. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote unauthenticated attacker may be able to gain escalated       privileges, escalate the privileges of the radvd process, overwrite files       with specific names, or cause a Denial of Service. Local attackers may be       able to overwrite the contents of arbitrary files using symlinks.
  Workaround :

    There is no known workaround at this time.

Vasiliy Kulikov discovered that radvd incorrectly parsed the ND_OPT_DNSSL_INFORMATION option. A remote attacker could exploit this with a specially crafted request and cause the radvd daemon to crash, or possibly execute arbitrary code. The default compiler options for affected releases should reduce the vulnerability to a denial of service. This issue only affected Ubuntu 11.04 and 11.10.
(CVE-2011-3601)

Vasiliy Kulikov discovered that radvd incorrectly filtered interface names when creating certain files. A local attacker could exploit this to overwrite certain files on the system, bypassing intended permissions. (CVE-2011-3602)

Vasiliy Kulikov discovered that radvd incorrectly handled certain lengths. A remote attacker could exploit this to cause the radvd daemon to crash, resulting in a denial of service. (CVE-2011-3604)

Vasiliy Kulikov discovered that radvd incorrectly handled delays when used in unicast mode, which is not the default in Ubuntu. If used in unicast mode, a remote attacker could cause radvd outages, resulting in a denial of service. (CVE-2011-3605).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

update to latest upstream radvd-1.8.2 fixes CVE-2011-3601, CVE-2011-3602, CVE-2011-3603, CVE-2011-3604, CVE-2011-= 3605
----------------------------------------------------------------------
-----=

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple security issues were discovered by Vasiliy Kulikov in radvd, an IPv6 Router Advertisement daemon :

  - CVE-2011-3602     set_interface_var() function doesn't check the interface     name, which is chosen by an unprivileged user. This     could lead to an arbitrary file overwrite if the     attacker has local access, or specific files overwrites     otherwise.

  - CVE-2011-3604     process_ra() function lacks multiple buffer length     checks which could lead to memory reads outside the     stack, causing a crash of the daemon.

  - CVE-2011-3605     process_rs() function calls mdelay() (a function to wait     for a defined time) unconditionnally when running in     unicast-only mode. As this call is in the main thread,     that means all request processing is delayed (for a time     up to MAX_RA_DELAY_TIME, 500 ms by default). An attacker     could flood the daemon with router solicitations in     order to fill the input queue, causing a temporary     denial of service (processing would be stopped during     all the mdelay() calls). Note: upstream and Debian     default is to use anycast mode.

ID	Name	Product	Family	Severity
200036	RHEL 4 : radvd (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
200005	RHEL 6 : radvd (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
199968	RHEL 5 : radvd (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
76008	openSUSE Security Update : radvd (openSUSE-SU-2011:1247-1)	Nessus	SuSE Local Security Checks	high
75724	openSUSE Security Update : radvd (openSUSE-SU-2011:1247-1)	Nessus	SuSE Local Security Checks	high
57251	SuSE 10 Security Update : radvd (ZYPP Patch Number 7824)	Nessus	SuSE Local Security Checks	high
57133	SuSE 11.1 Security Update : radvd (SAT Patch Number 5397)	Nessus	SuSE Local Security Checks	high
56904	GLSA-201111-08 : radvd: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
56776	Ubuntu 10.04 LTS / 10.10 / 11.04 / 11.10 : radvd vulnerabilities (USN-1257-1)	Nessus	Ubuntu Local Security Checks	high
56717	Fedora 16 : radvd-1.8.2-2.fc16 (2011-13989)	Nessus	Fedora Local Security Checks	high
56669	Debian DSA-2323-1 : radvd - several vulnerabilities	Nessus	Debian Local Security Checks	high
56656	Fedora 15 : radvd-1.8.2-2.fc15 (2011-14022)	Nessus	Fedora Local Security Checks	high
56655	Fedora 14 : radvd-1.8.2-2.fc14 (2011-14000)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2011-3605

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high