Stack-based buffer overflow in the bgp_route_refresh_receive function in bgp_packet.c in bgpd in Quagga before 0.99.17 allows remote authenticated users to cause a denial of service (daemon crash) or possibly execute arbitrary code via a malformed Outbound Route Filtering (ORF) record in a BGP ROUTE-REFRESH (RR) message.
CVSS Details
- CVSS 3.1 Base Score: 8.1
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade quagga-contribUpgrade quaggaUpgrade quagga-devel | Dec 1, 2016 | Sep 10, 2010 |
| Gentoo Linux | — | Upgrade net-misc/quagga. | Oct 30, 2017 | Sep 10, 2010 |
| Oracle Solaris | — | Upgrade system/network/routing/quagga to version 0.99.19-0.175.0.4.0.2.0 on Solaris 11.0 | May 29, 2017 | Sep 10, 2010 |
| Oracle_linux | — | Upgrade quagga-contribUpgrade quaggaUpgrade quagga-devel | Oct 16, 2024 | Sep 10, 2010 |
| Redhat_linux | — | — | Jul 9, 2025 | Aug 19, 2010 |
| Suse | — | Upgrade quaggaUpgrade quagga-devel | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade quagga | Nov 8, 2024 | Sep 10, 2010 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub