The bgp_dump_routes_func function in bgpd/bgp_dump.c in Quagga does not perform size checks when dumping data, which might allow remote attackers to cause a denial of service (assertion failure and daemon crash) via a large BGP packet.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade quagga-develUpgrade quagga-contribUpgrade quaggaUpgrade quagga-debuginfo | Aug 28, 2019 | May 23, 2016 |
| Debian | — | Upgrade quagga | Aug 26, 2016 | May 23, 2016 |
| Gentoo Linux | — | Upgrade net-misc/quagga. | Oct 30, 2017 | May 23, 2016 |
| Huawei Euleros 2_0_sp2 | — | Upgrade quagga | Dec 4, 2019 | May 23, 2016 |
| Huawei Euleros 2_0_sp3 | — | Upgrade quagga | Dec 18, 2019 | May 23, 2016 |
| Huawei Euleros 2_0_sp5 | — | Upgrade quagga | Feb 3, 2021 | May 23, 2016 |
| Oracle Solaris | — | Upgrade system/network/routing/quagga to version 0.99.19-0.175.3.18.0.2.0 on Solaris 11.3 | May 29, 2017 | May 23, 2016 |
| Oracle_linux | — | Upgrade quagga-develUpgrade quaggaUpgrade quagga-contrib | Mar 28, 2017 | Apr 27, 2016 |
| Redhat_linux | — | No solution existsUpgrade quaggaUpgrade quagga-debuginfoUpgrade quagga-develUpgrade quagga-contrib | Mar 26, 2017 | May 23, 2016 |
| Suse | — | Upgrade quaggaUpgrade libquagga_pb0Upgrade libospf0Upgrade libzebra1Upgrade libospfapiclient0Upgrade quagga-develUpgrade libfpm_pb0 | May 23, 2016 | May 23, 2016 |
| Ubuntu | — | Upgrade quagga | Oct 13, 2016 | May 23, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub