CVE-2008-2476

The IPv6 Neighbor Discovery Protocol (NDP) implementation in (1) FreeBSD 6.3 through 7.1, (2) OpenBSD 4.2 and 4.3, (3) NetBSD, (4) Force10 FTOS before E7.7.1.1, (5) Juniper JUNOS, and (6) Wind River VxWorks 5.x through 6.4 does not validate the origin of Neighbor Discovery messages, which allows remote attackers to cause a denial of service (loss of connectivity) or read private network traffic via a spoofed message that modifies the Forward Information Base (FIB).

• CWE-20

• ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2008-013.txt.asc
• http://secunia.com/advisories/32112Vendor Advisory
• http://secunia.com/advisories/32116
• http://secunia.com/advisories/32117Vendor Advisory
• http://secunia.com/advisories/32133
• http://secunia.com/advisories/32406
• http://security.freebsd.org/advisories/FreeBSD-SA-08:10.nd6.ascVendor Advisory
• http://securitytracker.com/id?1020968
• http://support.apple.com/kb/HT3467
• http://www.kb.cert.org/vuls/id/472363US Government Resource
• http://www.kb.cert.org/vuls/id/MAPG-7H2RY7US Government Resource
• http://www.kb.cert.org/vuls/id/MAPG-7H2S68US Government Resource
• http://www.openbsd.org/errata42.html#015_ndp
• http://www.openbsd.org/errata43.html#006_ndp
• http://www.securityfocus.com/bid/31529
• http://www.securitytracker.com/id?1021109
• http://www.securitytracker.com/id?1021132
• http://www.vupen.com/english/advisories/2008/2750
• http://www.vupen.com/english/advisories/2008/2751
• http://www.vupen.com/english/advisories/2008/2752
• http://www.vupen.com/english/advisories/2009/0633
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45601
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5670
• https://www.juniper.net/alerts/viewalert.jsp?actionBtn=Search&txtAlertNumber=PSN-2008-09-036&viewMode=view
• ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2008-013.txt.asc
• http://secunia.com/advisories/32112Vendor Advisory
• http://secunia.com/advisories/32116
• http://secunia.com/advisories/32117Vendor Advisory
• http://secunia.com/advisories/32133
• http://secunia.com/advisories/32406
• http://security.freebsd.org/advisories/FreeBSD-SA-08:10.nd6.ascVendor Advisory
• http://securitytracker.com/id?1020968
• http://support.apple.com/kb/HT3467
• http://www.kb.cert.org/vuls/id/472363US Government Resource
• http://www.kb.cert.org/vuls/id/MAPG-7H2RY7US Government Resource
• http://www.kb.cert.org/vuls/id/MAPG-7H2S68US Government Resource
• http://www.openbsd.org/errata42.html#015_ndp
• http://www.openbsd.org/errata43.html#006_ndp
• http://www.securityfocus.com/bid/31529
• http://www.securitytracker.com/id?1021109
• http://www.securitytracker.com/id?1021132
• http://www.vupen.com/english/advisories/2008/2750
• http://www.vupen.com/english/advisories/2008/2751
• http://www.vupen.com/english/advisories/2008/2752
• http://www.vupen.com/english/advisories/2009/0633
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45601
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5670
• https://www.juniper.net/alerts/viewalert.jsp?actionBtn=Search&txtAlertNumber=PSN-2008-09-036&viewMode=view

Published

Oct 3, 2008

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2008-2464The mld_input function in sys/netinet6/mld6.c in the kernel …
• CVE-2008-2468Multiple buffer overflows in the QIP Server Service (aka qip…
• CVE-2008-2469Heap-based buffer overflow in the SPF_dns_resolv_lookup func…
• CVE-2008-2470The InstallShield Update Service Agent ActiveX control in is…
• CVE-2008-2474Buffer overflow in x87 before 3.5.5 in ABB Process Communica…
• CVE-2008-2475eBay Enhanced Picture Uploader ActiveX control (EPUWALcontro…
• CVE-2008-2477SQL injection vulnerability in index.php in MxBB (aka MX-Sys…
• CVE-2008-2478scripts/wwwacct in cPanel 11.18.6 STABLE and earlier and 11.…
• CVE-2008-2479Multiple SQL injection vulnerabilities in phpFix 2.0 allow r…
• CVE-2008-2480PHP remote file inclusion vulnerability in plus.php in plusP…
• CVE-2008-2481PHP remote file inclusion vulnerability in authentication/ph…
• CVE-2008-2482Directory traversal vulnerability in install_mod.php in insa…