radvd: Multiple vulnerabilities — GLSA 201111-08

Multiple vulnerabilities have been found in radvd which could potentially lead to privilege escalation, data loss, or a Denial of Service.

Affected packages

Background

radvd is an IPv6 router advertisement daemon for Linux and BSD.

Description

Multiple vulnerabilities have been discovered in radvd. Please review the CVE identifiers referenced below for details.

Impact

A remote unauthenticated attacker may be able to gain escalated privileges, escalate the privileges of the radvd process, overwrite files with specific names, or cause a Denial of Service. Local attackers may be able to overwrite the contents of arbitrary files using symlinks.

Workaround

There is no known workaround at this time.

Resolution

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=net-misc/radvd-1.8.2"
 

References

• CVE-2011-3601
• CVE-2011-3602
• CVE-2011-3603
• CVE-2011-3604
• CVE-2011-3605

Release date
November 20, 2011

Latest revision
November 20, 2011: 1

Severity
high

Exploitable
local, remote

Bugzilla entries

• 385967