What is the CVSS score of CVE-2014-3554?

CVE-2014-3554 has a CVSS 2.0 base score of 6.8 (Medium). CVSS vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. EPSS exploitation probability: 0.6%.

Is there a patch available for CVE-2014-3554?

Yes, a patch is available for CVE-2014-3554. Update the affected software to the latest version immediately.

Libndp CVE-2014-3554

MEDIUM

Classic Buffer Overflow (CWE-120)

2014-07-31 secalert@redhat.com

Denial Of Service RCE Buffer Overflow Libndp

6.8

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

6.8 MEDIUM

AV:N/AC:M/Au:N/C:P/I:P/A:P

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:M/Au:N/C:P/I:P/A:P

Attack Vector

Network

Attack Complexity

Confidentiality

Integrity

Availability

Lifecycle Timeline

CVE Published

Jul 31, 2014 - 14:55 cve.org

MEDIUM 6.8

DescriptionCVE.org

AnalysisAI

Buffer overflow in the ndp_msg_opt_dnssl_domain function in libndp allows remote routers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted DNS Search List (DNSSL). Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. This Buffer Copy without Size Check vulnerability could allow attackers to overflow a buffer to corrupt adjacent memory.

Technical ContextAI

This vulnerability is classified as Buffer Copy without Size Check (CWE-120), which allows attackers to overflow a buffer to corrupt adjacent memory. Buffer overflow in the ndp_msg_opt_dnssl_domain function in libndp allows remote routers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted DNS Search List (DNSSL) in an IPv6 router advertisement. Affected products include: Libndp.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Always validate buffer sizes before copy operations. Use bounded functions (strncpy, snprintf). Enable compiler protections.