libndp provides a library for the IPv6 Neighbor Discovery Protocol. A buffer overflow flaw was found in the ndp_msg_opt_dnssl_domain() function when handling the DNS Search List (DNSSL) in IPv6 router advertisements. A malicious router or man-in-the-middle attacker could use this flaw to cause an application using libndp to crash or, potentially, execute arbitrary code.
Created attachment 917255 [details] patch from original reporter
Acknowledgements: Red Hat would like to thank Andrew Ayer for reporting this issue.
This issue is public now: http://www.openwall.com/lists/oss-security/2014/07/29/2
Created libndp tracking bugs for this issue: Affects: fedora-all [bug 1124396]
Statement: Red Hat Product Security has rated this issue as having Moderate security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.