CVE-2016-3698
Fixed in a distro release EPSS 4%
libndp before 1.6, as used in NetworkManager, does not properly validate the origin of Neighbor Discovery Protocol (NDP) messages, which allows remote attackers to conduct man-in-the-middle attacks or cause a denial of service (network connectivity disruption) by advertising a node as a router from a non-local network.
Products: redhat enterprise_linux_desktop, redhat enterprise_linux_hpc_node, redhat enterprise_linux_hpc_node_eus, redhat enterprise_linux_server, redhat enterprise_linux_server_aus, redhat enterprise_linux_server_eus, redhat enterprise_linux_workstation, libndp, debian_linux, canonical ubuntu_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | libndp | 1.6-1 |
| Debian 13 | libndp | 1.6-1 |
| Debian 14 | libndp | 1.6-1 |
| Debian 8 | libndp | 1.4-2+deb8u1 |
| Red Hat Enterprise Linux 7 | libndp | 0:1.2-6.el7_2 |
| Red Hat Enterprise Linux 7 | libndp-debuginfo | 0:1.2-6.el7_2 |
| Red Hat Enterprise Linux 7 | libndp-devel | 0:1.2-6.el7_2 |
| Ubuntu 16.04 LTS | libndp | 1.4-2ubuntu0.16.04.1 |
| openSUSE Tumbleweed | libndp | 1.6-2.3 |