bgpd in Quagga before 0.99.9 allows explicitly configured BGP peers to cause a denial of service (crash) via a malformed (1) OPEN message or (2) a COMMUNITY attribute, which triggers a NULL pointer dereference. NOTE: vector 2 only exists when debugging is enabled.
CVSS Details
- CVSS 3.1 Base Score: 2.6
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade quagga-contribUpgrade quaggaUpgrade quagga-devel | Dec 1, 2016 | Sep 12, 2007 |
| Oracle Solaris | — | Upgrade system/network/routing/quagga to version 0.99.19-0.175.0.4.0.2.0 on Solaris 11.0 | May 29, 2017 | Sep 12, 2007 |
| Oracle_linux | — | Upgrade quagga-contribUpgrade quagga-develUpgrade quagga | Oct 16, 2024 | Sep 12, 2007 |
| Ubuntu | — | Upgrade quagga | Nov 8, 2024 | Sep 12, 2007 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub