CVE-2011-3603: Input Validation
The radvd daemon would not fail on privsepinit() errors, which could cause it to run with full root privileges when it should be running as an unprivileged user. (CVE-2011-3603)
This is corrected in upstream git [1], [2], [3].
[1] https://github.com/reubenhwk/radvd/commit/2c50375043186e133f15135f4c93ca964238ee60 [2] https://github.com/reubenhwk/radvd/commit/074816cd0b37aac7b3209987e6e998f0a847b275 [3] https://github.com/reubenhwk/radvd/commit/7dc53cc3b792775369bf0b2f053a3f4ed5d87e3d
Acknowledgements:
Red Hat would like to thank Vasiliy Kulikov of Openwall for reporting this issue.
Other sources
The router advertisement daemon (radvd) before 1.8.2 does not properly handle errors in the privsepinit function, which causes the radvd daemon to run as root and has an unspecified impact.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2011-3603?
CVE-2011-3603 has a medium severity rating due to the potential for the radvd daemon to run with elevated privileges.
How do I fix CVE-2011-3603?
To fix CVE-2011-3603, upgrade the Litech Router Advertisement Daemon to version 1.8.2 or later.
What does CVE-2011-3603 affect?
CVE-2011-3603 affects versions of the Litech Router Advertisement Daemon up to and including 1.8.1.
What are the consequences of CVE-2011-3603?
The consequences of CVE-2011-3603 include the risk of the radvd daemon executing with full root privileges instead of as an unprivileged user.
Is there a workaround for CVE-2011-3603?
There is no documented workaround for CVE-2011-3603; the recommended solution is to apply the software update.