Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.8

Miredo lets attackers impersonate a Teredo client

CVE-2006-6858 · published 19 years ago
Summary

Versions 0.9.8 to 1.0.5 of the Miredo software can be tricked into accepting a false Teredo client during its connection setup. This means a remote attacker could pretend to be any legitimate client, potentially gaining unauthorized network access. Update to a newer version of Miredo as soon as possible or apply the vendor's recommended mitigation.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
miredo miredo <= 1.0.5
0.9.8
1.0.3
1.0.4
cpe:2.3:a:miredo:miredo:*:*:*:*:*:*:*:*
Original advisory text
Miredo 0.9.8 through 1.0.5 does not properly authenticate a Teredo bubble during UDP hole punching with HMAC-MD5-64 hashing, which allows remote attackers to impersonate an arbitrary Teredo client.
Miredo 0.9.8 through 1.0.5 does not properly authenticate a Teredo bubble during UDP hole punching with HMAC-MD5-64 hashing, which allows remote attackers to impersonate an arbitrary Teredo client.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
6.8 Medium
Exploitation
1% chance of attack within 30 days
Timeline
Published31 Dec 2006
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2006-6858 · NVD
Track software like this
Free during beta