Buffer overflow in the lldp_decode function in daemon/protocols/lldp.c in lldpd before 0.8.0 allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via vectors involving large management addresses and TLV boundaries.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:2205 advisory.

    Open vSwitch provides standard network bridging functions and support for     the OpenFlow protocol for remote per-flow control of traffic.

    Security Fix(es):

    * buffer overflow in the lldp_decode function in daemon/protocols/lldp.c     (CVE-2015-8011)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2077 advisory.

    Open vSwitch provides standard network bridging functions and support for     the OpenFlow protocol for remote per-flow control of traffic.

    Security Fix(es):

    * lldpd: buffer overflow in the lldp_decode function in daemon/protocols/lldp.c     (CVE-2015-8011)

    * openvswitch: limitation in the OVS packet parsing in userspace leads to DoS     (CVE-2020-35498)

    * lldp/openvswitch: denial of service via externally triggered memory leak     (CVE-2020-27827)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:0988 advisory.

    The RHV-M Virtual Appliance automates the process of installing and configuring the Red Hat Virtualization     Manager. The appliance is available to download as an OVA file from the Customer Portal.

    The following packages have been upgraded to a later upstream version: rhvm-appliance (4.4). (BZ#1915881)

    Security Fix(es):

    * lldpd: buffer overflow in the lldp_decode function in daemon/protocols/lldp.c (CVE-2015-8011)

    * postgresql: Uncontrolled search path element in logical replication (CVE-2020-14349)

    * postgresql: Uncontrolled search path element in CREATE EXTENSION (CVE-2020-14350)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0931 advisory.

    Open vSwitch provides standard network bridging functions and support for     the OpenFlow protocol for remote per-flow control of traffic.

    OVN, the Open Virtual Network, is a system to support virtual network     abstraction.  OVN complements the existing capabilities of OVS to add native support for virtual network     abstractions, such as virtual L2 and L3 overlays and security groups.

    Security Fix(es):

    * buffer overflow in the lldp_decode function in daemon/protocols/lldp.c     (CVE-2015-8011)

    * librte_vhost Integer overflow in vhost_user_set_log_base()     (CVE-2020-10722)

    * librte_vhost Integer truncation in     vhost_user_check_and_alloc_queue_pair() (CVE-2020-10723)

    * librte_vhost Missing inputs validation in Vhost-crypto (CVE-2020-10724)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 33 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2021-fba11d37ee advisory.

  - Buffer overflow in the lldp_decode function in daemon/protocols/lldp.c in lldpd before 0.8.0 allows remote     attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via vectors     involving large management addresses and TLV boundaries. (CVE-2015-8011)

  - A flaw was found in multiple versions of OpenvSwitch. Specially crafted LLDP packets can cause memory to     be lost when allocating data to handle specific optional TLVs, potentially causing a denial of service.
    The highest threat from this vulnerability is to system availability. (CVE-2020-27827)

  - A vulnerability was found in openvswitch. A limitation in the implementation of userspace packet parsing     can allow a malicious user to send a specially crafted packet causing the resulting megaflow in the kernel     to be too wide, potentially causing a denial of service. The highest threat from this vulnerability is to     system availability. (CVE-2020-35498)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Several issues have been found in openvswitch, a production quality, multilayer, software-based, Ethernet virtual switch.

CVE-2020-35498

Denial of service attacks, in which crafted network packets could cause the packet lookup to ignore network header fields from layers 3 and 4. The crafted network packet is an ordinary IPv4 or IPv6 packet with Ethernet padding length above 255 bytes. This causes the packet sanity check to abort parsing header fields after layer 2.

CVE-2020-27827

Denial of service attacks using crafted LLDP packets.

CVE-2018-17206

Buffer over-read issue during BUNDLE action decoding.

CVE-2018-17204

Assertion failure due to not validating information (group type and command) in OF1.5 decoder.

CVE-2017-9214

Buffer over-read that is caused by an unsigned integer underflow.

CVE-2015-8011

Buffer overflow in the lldp_decode function in daemon/protocols/lldp.c in lldpd before 0.8.0 allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via vectors involving large management addresses and TLV boundaries.

For Debian 9 stretch, these problems have been fixed in version 2.6.10-0+deb9u1. This version is a new upstream point release.

We recommend that you upgrade your openvswitch packages.

For the detailed security status of openvswitch please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/openvswitch

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Two vulnerabilities were discovered in the LLPD implementation of Open vSwitch, a software-based Ethernet virtual switch, which could result in denial of service.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4691-1 advisory.

    Jonas Rudloff discovered that Open vSwitch incorrectly handled certain malformed LLDP packets. A remote     attacker could use this issue to cause Open vSwitch to crash, resulting in a denial of service, or     possibly execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:0028 advisory.

    The redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include     redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH)     are installed using a special build of Red Hat Enterprise Linux with only the packages required to host     virtual machines. RHVH features a Cockpit user interface for monitoring the host's resources and     performing administrative tasks.

    The ovirt-node-ng packages provide the Red Hat Virtualization Host. These packages include redhat-release-     virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH) are installed     using a special build of Red Hat Enterprise Linux with only the packages required to host virtual     machines. RHVH features a Cockpit user interface for monitoring the host's resources and performing     administrative tasks.

    The following packages have been upgraded to a later upstream version: openvswitch2.11 (2.11.3), ovn2.11     (2.11.1), redhat-release-virtualization-host (4.3.12), redhat-virtualization-host (4.3.12). (BZ#1898513,     BZ#1907537, BZ#1907538)

    Security Fix(es):

    * lldpd: buffer overflow in the lldp_decode function in daemon/protocols/lldp.c (CVE-2015-8011)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:5615 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    Security Fix(es):

    * lldpd: buffer overflow in the lldp_decode function in daemon/protocols/lldp.c (CVE-2015-8011)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.6.9. See the following     advisory for the container images for this release:

    https://access.redhat.com/errata/RHBA-2020:5614

    All OpenShift Container Platform 4.6 users are advised to upgrade to these updated packages and images     when they are available in the appropriate release channel. To check for available updates, use the     OpenShift Console or the CLI oc command. Instructions for upgrading a cluster are available at     https://docs.openshift.com/container-platform/4.6/updating/updating-cluster-between-     minor.html#understanding-upgrade-channels_updating-cluster-between-minor.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5611 advisory.

    The redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include     redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH)     are installed using a special build of Red Hat Enterprise Linux with only the packages required to host     virtual machines. RHVH features a Cockpit user interface for monitoring the host's resources and     performing administrative tasks.

    The ovirt-node-ng packages provide the Red Hat Virtualization Host. These packages include redhat-release-     virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH) are installed     using a special build of Red Hat Enterprise Linux with only the packages required to host virtual     machines. RHVH features a Cockpit user interface for monitoring the host's resources and performing     administrative tasks.

    The following packages have been upgraded to a later upstream version: cockpit-ovirt (0.14.15), redhat-     release-virtualization-host (4.4.3), redhat-virtualization-host (4.4.3), v2v-conversion-host (1.16.2).
    (BZ#1898023, BZ#1902301, BZ#1907539)

    Security Fix(es):

    * lldpd: buffer overflow in the lldp_decode function in daemon/protocols/lldp.c (CVE-2015-8011)

    * nodejs-lodash: prototype pollution in zipObjectDeep function (CVE-2020-8203)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Previously, upgrade from Red Had Virtualization (RHV) 4.4.1 to RHV 4.4.2 failed due to dangling symlinks     from the iSCSI Storage Domain that weren't cleaned up. In this release, the upgrade succeeds. (BZ#1895356)

    * Previously, when migrating a Windows virtual machine from a VMware environment to Red Hat Virtualization     4.4.3, the migration failed due to a file permission error. In this release, the migration succeeds.
    (BZ#1901423)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The lldpd developer Vincent Bernat reports :

A buffer overflow may allow arbitrary code execution only if hardening was disabled.

Malformed packets should not make lldpd crash. Ensure we can handle them by not using assert() in this part.

ID	Name	Product	Family	Severity
150149	RHEL 7 : Red Hat OpenStack Platform 10.0 (openvswitch) (RHSA-2021:2205)	Nessus	Red Hat Local Security Checks	critical
149839	RHEL 7 : openvswitch (RHSA-2021:2077)	Nessus	Red Hat Local Security Checks	critical
148122	RHEL 8 : rhvm-appliance (RHSA-2021:0988)	Nessus	Red Hat Local Security Checks	critical
147881	RHEL 7 : openvswitch2.11 and ovn2.11 (RHSA-2021:0931)	Nessus	Red Hat Local Security Checks	critical
147151	Fedora 33 : 2:dpdk / openvswitch (2021-fba11d37ee)	Nessus	Fedora Local Security Checks	critical
146677	Debian DLA-2571-1 : openvswitch security update	Nessus	Debian Local Security Checks	critical
145309	Debian DSA-4836-1 : openvswitch - security update	Nessus	Debian Local Security Checks	critical
144943	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Open vSwitch vulnerabilities (USN-4691-1)	Nessus	Ubuntu Local Security Checks	critical
144765	RHEL 7 : Red Hat Virtualization (RHSA-2021:0028)	Nessus	Red Hat Local Security Checks	critical
144509	RHEL 8 : OpenShift Container Platform 4.6.9 (RHSA-2020:5615)	Nessus	Red Hat Local Security Checks	critical
144405	RHEL 8 : Red Hat Virtualization (RHSA-2020:5611)	Nessus	Red Hat Local Security Checks	critical
86620	FreeBSD : lldpd -- Buffer overflow/Denial of service (2a4a112a-7c1b-11e5-bd77-0800275369e2)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2015-8011

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical