It was discovered that the zebra daemon in Quagga before 1.0.20161017 suffered from a stack-based buffer overflow when processing IPv6 Neighbor Discovery messages. The root cause was relying on BUFSIZ to be compatible with a message size; however, BUFSIZ is system-dependent.
CVSS Details
- CVSS 3.0 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade quagga | Sep 20, 2017 | Feb 22, 2017 |
| Centos_linux | — | Upgrade quagga-debuginfoUpgrade quagga-contribUpgrade quagga-develUpgrade quagga | Aug 28, 2019 | Feb 22, 2017 |
| Debian | — | Upgrade quagga | Oct 19, 2016 | Oct 18, 2016 |
| Gentoo Linux | — | Upgrade net-misc/quagga. | Oct 30, 2017 | Feb 22, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade quagga | Dec 4, 2019 | Feb 22, 2017 |
| Huawei Euleros 2_0_sp3 | — | Upgrade quagga | Dec 18, 2019 | Feb 22, 2017 |
| Huawei Euleros 2_0_sp5 | — | Upgrade quagga | Nov 19, 2019 | Feb 22, 2017 |
| Oracle Solaris | — | Upgrade system/network/routing/quagga to version 0.99.19-0.175.3.31.0.3.0 on Solaris 11.3 | Apr 18, 2018 | Feb 22, 2017 |
| Oracle_linux | — | Upgrade quagga-develUpgrade quagga-contribUpgrade quagga | Mar 28, 2017 | Oct 18, 2016 |
| Redhat_linux | — | Upgrade quagga-debuginfoUpgrade quagga-develNo solution existsUpgrade quaggaUpgrade quagga-contrib | Mar 26, 2017 | Oct 18, 2016 |
| Suse | — | Upgrade quagga-develUpgrade libquagga_pb0Upgrade libospfapiclient0Upgrade libzebra1Upgrade quaggaUpgrade libospf0Upgrade libfpm_pb0 | Oct 19, 2016 | Oct 18, 2016 |
| Ubuntu | — | Upgrade quagga | Oct 25, 2016 | Oct 18, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub