Denial of Service Vulnerability in radvd Package: CVE-2011-3605
Summary
CVE-2011-3605: The process_rs function in the router advertisement daemon (radvd) before 1.8.2, when UnicastOnly is enabled, allows remote attackers to cause a denial of service (temporary service hang) via a large number of ND_ROUTER_... Affects radvd versions < 1:1.8-1.1. Fixed in 1:1.8-1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The router advertisement daemon (radvd) is a critical component in IPv6 networking, responsible for sending router advertisements to inform hosts of available routers on the network. It is widely used in various Linux distributions, including Debian. The package is designed to facilitate the automatic configuration of network settings for IPv6-enabled devices. However, certain configurations, particularly when 'UnicastOnly' is enabled, expose the service to potential denial of service attacks, making it crucial for users to be aware of its vulnerabilities.
Vulnerability Detail
CVE-2011-3605 is a vulnerability in the radvd package prior to version 1.8.2. When the 'UnicastOnly' option is enabled, the process_rs function can be exploited by remote attackers. By sending a large number of ND_ROUTER_SOLICIT requests, an attacker can cause a temporary service hang, leading to a denial of service. This vulnerability can disrupt network operations and affect all devices relying on radvd for router advertisements, making it a significant concern for network administrators.
How To Fix
Minimum fixed version
1:1.8-1.1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade radvdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, consider disabling the 'UnicastOnly' option in the radvd configuration file to mitigate the risk until a proper update can be applied. This can be done by editing the radvd.conf file and ensuring that the UnicastOnly directive is set to false.
Conclusion
CVE-2011-3605 presents a significant denial of service vulnerability in the radvd package, particularly when the 'UnicastOnly' option is enabled. Users are strongly advised to upgrade to version 1.8.2 or later to mitigate this risk. In the meantime, disabling the 'UnicastOnly' option can serve as a temporary workaround. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for radvd →
FAQ
CVE-2011-3605 is a vulnerability in the radvd package that allows remote attackers to cause a denial of service by sending numerous ND_ROUTER_SOLICIT requests.
You can use the Vulert platform to check if your application is affected by this vulnerability. Simply upload your manifest file like package-lock.json to monitor and alert for open-source vulnerabilities.
The primary consequence is a denial of service, which can temporarily disrupt network operations and affect all devices relying on radvd for router advertisements.
Yes, you can disable the 'UnicastOnly' option in the radvd configuration file as a temporary workaround until you can upgrade.
More information about radvd can be found in the official documentation and the Debian package repository.
Related vulnerabilities
Recent vulnerabilities recorded for radvd.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.