Cloudanix VulnDB

CVE-2016-3698

High · 8.1

CVSS

8.1

EPSS

3.8%

Published

Jun 13, 2016

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in a common networking component lets attackers on the network pretend to be a router and either steal data or cut off connections until the software is updated.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Moderate
Impact
Data Tampering
Component
Library
Class
Authorization Bypass
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The library accepts NDP router advertisements without verifying they originate from the local link, allowing an attacker to inject forged router information that alters routing tables or redirects traffic.

Why it matters to the business

Attackers can intercept network traffic or disrupt connectivity across systems using the affected library, leading to data exposure or service outages that require emergency network changes.

How an attack unfolds

An attacker on an adjacent or routed network crafts and sends NDP router advertisement messages that appear to come from a legitimate local router; the vulnerable library processes these messages without origin checks, causing the host to update its default route or neighbor cache and enabling traffic interception or denial of service.

How to fix it

Upgrade libndp to the commit 2af9a55b38b55abbf05fd116ec097d4029115839 or later release that enforces origin validation on NDP messages; rebuild and redeploy any dependent NetworkManager packages.

How to confirm the fix worked

Confirm the installed libndp version or commit hash matches or exceeds 2af9a55b38b55abbf05fd116ec097d4029115839; test by attempting to inject a non-local router advertisement and verify it is dropped.

Typical attack path

  1. Position to send IPv6 NDP packets toward target hosts
  2. Craft forged router advertisement claiming a non-local node as default gateway
  3. Send the advertisement to trigger route or neighbor cache update
  4. Intercept or drop traffic once the poisoned route is active

How to detect it

Review system and network logs for unexpected NDP router advertisements containing non-local addresses or originating from external interfaces; correlate with host route table changes or neighbor cache entries added without local link confirmation.

What your security team should do

  • Immediately update all instances of libndp to the fixed commit
  • Scan package inventories for any remaining pre-1.6 versions
  • Monitor network logs for unexpected router advertisements after patching

The record

libndp before 1.6, as used in NetworkManager, does not properly validate the origin of Neighbor Discovery Protocol (NDP) messages, which allows remote attackers to conduct man-in-the-middle attacks or cause a denial of service (network connectivity disruption) by advertising a node as a router from a non-local network.

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 libndp 0 1.6-1
Debian:12 libndp 0 1.6-1
Debian:13 libndp 0 1.6-1
Debian:8 libndp 0 1.4-2+deb8u1
Mageia:5 libndp 0 1.4-3.1.mga5
Red Hat:enterprise_linux:7::client libndp 0 0:1.2-6.el7_2
Red Hat:enterprise_linux:7::client libndp-debuginfo 0 0:1.2-6.el7_2
Red Hat:enterprise_linux:7::client libndp-devel 0 0:1.2-6.el7_2
Red Hat:enterprise_linux:7::computenode libndp 0 0:1.2-6.el7_2
Red Hat:enterprise_linux:7::computenode libndp-debuginfo 0 0:1.2-6.el7_2
Red Hat:enterprise_linux:7::computenode libndp-devel 0 0:1.2-6.el7_2
Red Hat:enterprise_linux:7::server libndp 0 0:1.2-6.el7_2
Red Hat:enterprise_linux:7::server libndp-debuginfo 0 0:1.2-6.el7_2
Red Hat:enterprise_linux:7::server libndp-devel 0 0:1.2-6.el7_2
Red Hat:enterprise_linux:7::workstation libndp 0 0:1.2-6.el7_2
Red Hat:enterprise_linux:7::workstation libndp-debuginfo 0 0:1.2-6.el7_2
Red Hat:enterprise_linux:7::workstation libndp-devel 0 0:1.2-6.el7_2
Ubuntu:16.04:LTS libndp 0 1.4-2ubuntu0.16.04.1
openSUSE:Tumbleweed libndp 0 1.6-2.3

Related vulnerabilities