A vulnerability was found in libndp. A buffer overflow in NetworkManager that can be triggered by sending a malformed IPv6 router advertisement packet via malicious user locally. This happens as libndp was not validating correctly the route length information and hence leading to a flaw. This affects versions of libndp >= 1.0.

Buffer overflow in the ndpmsgoptdnssldomain function in libndp allows remote routers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted DNS Search List (DNSSL) in an IPv6 router advertisement.

libndp before 1.6, as used in NetworkManager, does not properly validate the origin of Neighbor Discovery Protocol (NDP) messages, which allows remote attackers to conduct man-in-the-middle attacks or cause a denial of service (network connectivity disruption) by advertising a node as a router from a non-local network.

libndp provides a library for the IPv6 Neighbor Discovery Protocol. A buffer overflow flaw was found in the ndpmsgoptdnssldomain() function when handling the DNS Search List (DNSSL) in IPv6 router advertisements. A malicious router or man-in-the-middle attacker could use this flaw to cause an application using libndp to crash or, potentially, execute arbitrary code.