openSUSE Security Update : radvd (openSUSE-SU-2011:1247-1)

This update of radvd fixes the following security flaws : - arbitrary file overwrite flaw through unsanitized interface names CVE-2011-3602, - missing return value checks in privsepinit which could cause radvd to keep running with root privileges CVE-2011-3603, - buffer overread flaws in the...

CVE-2011-3602

Directory traversal vulnerability in device-linux.c in the router advertisement daemon radvd before 1.8.2 allows local users to overwrite arbitrary files, and remote attackers to overwrite certain files, via a .. dot dot in an interface name. NOTE: this can be leveraged with a symlink to overwrit...

Directory traversal

Directory traversal vulnerability in device-linux.c in the router advertisement daemon radvd before 1.8.2 allows local users to overwrite arbitrary files, and remote attackers to overwrite certain files, via a .. dot dot in an interface name. NOTE: this can be leveraged with a symlink to overwrit...

CVE-2011-3603

The CVE-2011-3603 issue affects the router advertisement daemon (radvd) prior to version 1.8.2. The root cause is improper error handling in privsep_init, which can cause radvd to run with root privileges, leading to a partial confidentiality/integrity/availability impact as described (and noted ...

CVE-2011-3602

CVE-2011-3602 is a directory traversal vulnerability in the router advertisement daemon, radvd, affecting radvd before 1.8.2. An attacker can exploit an interface name containing a “..” to overwrite arbitrary files, and this can be leveraged with a symlink to overwrite additional files. The issue...

CVE-2011-3603

The router advertisement daemon radvd before 1.8.2 does not properly handle errors in the privsepinit function, which causes the radvd daemon to run as root and has an unspecified impact...

CVE-2011-3602

Directory traversal vulnerability in device-linux.c in the router advertisement daemon radvd before 1.8.2 allows local users to overwrite arbitrary files, and remote attackers to overwrite certain files, via a .. dot dot in an interface name. NOTE: this can be leveraged with a symlink to overwrit...

CVE-2011-3605

The processrs function in the router advertisement daemon radvd before 1.8.2, when UnicastOnly is enabled, allows remote attackers to cause a denial of service temporary service hang via a large number of NDROUTERSOLICIT requests...

CVE-2011-3604

The processra function in the router advertisement daemon radvd before 1.8.2 allows remote attackers to cause a denial of service stack-based buffer over-read and crash via unspecified vectors...

DEBIAN-CVE-2011-3604

The processra function in the router advertisement daemon radvd before 1.8.2 allows remote attackers to cause a denial of service stack-based buffer over-read and crash via unspecified vectors...

CVE-2011-3604

The processra function in the router advertisement daemon radvd before 1.8.2 allows remote attackers to cause a denial of service stack-based buffer over-read and crash via unspecified vectors...

CVE-2011-3605

The processrs function in the router advertisement daemon radvd before 1.8.2, when UnicastOnly is enabled, allows remote attackers to cause a denial of service temporary service hang via a large number of NDROUTERSOLICIT requests...

Code injection

The processrs function in the router advertisement daemon radvd before 1.8.2, when UnicastOnly is enabled, allows remote attackers to cause a denial of service temporary service hang via a large number of NDROUTERSOLICIT requests...

Stack overflow

The processra function in the router advertisement daemon radvd before 1.8.2 allows remote attackers to cause a denial of service stack-based buffer over-read and crash via unspecified vectors...

CVE-2011-3604

The CVE-2011-3604 issue affects the router advertisement daemon (radvd) process_ra() prior to version 1.8.2, enabling remote attackers to trigger a stack-based buffer over-read that crashes the service. Published advisories confirm the vulnerability exists in radvd and that fixes were delivered i...

CVE-2011-3601

CVE-2011-3601 affects radvd (router advertisement daemon). The vulnerability is a buffer overflow in the process_ra function, exploitable remotely via a negative label_len value in radvd before version 1.8.2. Public advisories across distributions (openSUSE SUSE-2011:1247-1, Fedora FEDORA-2011-13...

CVE-2011-3601

Buffer overflow in the processra function in the router advertisement daemon radvd before 1.8.2 allows remote attackers to execute arbitrary code or cause a denial of service crash via a negative value in a labellen value...

CVE-2011-3605

CVE-2011-3605 affects radvd (router advertisement daemon). The issue occurs in process_rs when UnicastOnly is enabled, where an attacker can cause a denial-of-service (temporary service hang) by sending a flood of ND_ROUTER_SOLICIT requests. Affected software is radvd prior to version 1.8.2. The ...

CVE-2011-3605

The processrs function in the router advertisement daemon radvd before 1.8.2, when UnicastOnly is enabled, allows remote attackers to cause a denial of service temporary service hang via a large number of NDROUTERSOLICIT requests...

CVE-2011-3601

Buffer overflow in the processra function in the router advertisement daemon radvd before 1.8.2 allows remote attackers to execute arbitrary code or cause a denial of service crash via a negative value in a labellen value...