Bug 1118583 (CVE-2014-3554) - CVE-2014-3554 libndp: buffer overflow flaw in DNS Search List (DNSSL) handling
Summary: CVE-2014-3554 libndp: buffer overflow flaw in DNS Search List (DNSSL) handling
Alias: CVE-2014-3554
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On: 1124396
Blocks: 1118584
TreeView+ depends on / blocked
Reported: 2014-07-11 05:40 UTC by Murray McAllister
Modified: 2023-05-12 16:04 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2015-01-20 16:53:45 UTC

Attachments (Terms of Use)
patch from original reporter (1.63 KB, patch)
2014-07-11 05:42 UTC, Murray McAllister
no flags Details | Diff

Description Murray McAllister 2014-07-11 05:40:20 UTC
libndp provides a library for the IPv6 Neighbor Discovery Protocol. A buffer overflow flaw was found in the ndp_msg_opt_dnssl_domain() function when handling the DNS Search List (DNSSL) in IPv6 router advertisements. A malicious router or man-in-the-middle attacker could use this flaw to cause an application using libndp to crash or, potentially, execute arbitrary code.

Comment 1 Murray McAllister 2014-07-11 05:42:36 UTC
Created attachment 917255 [details]
patch from original reporter

Comment 2 Murray McAllister 2014-07-14 04:27:02 UTC

Red Hat would like to thank Andrew Ayer for reporting this issue.

Comment 5 Murray McAllister 2014-07-29 12:10:00 UTC
This issue is public now:


Comment 6 Murray McAllister 2014-07-29 12:11:21 UTC
Created libndp tracking bugs for this issue:

Affects: fedora-all [bug 1124396]

Comment 8 Vincent Danen 2015-01-20 16:53:25 UTC

Red Hat Product Security has rated this issue as having Moderate security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Note You need to log in before you can comment on or make changes to this bug.