The bgp_dump_routes_func function in bgpd/bgp_dump.c in Quagga does not perform size checks when dumping data, which might allow remote attackers to cause a denial of service (assertion failure and daemon crash) via a large BGP packet.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade quaggaUpgrade quagga-contribUpgrade quagga-develUpgrade quagga-debuginfo | Aug 28, 2019 | May 23, 2016 |
| Debian | — | Upgrade quagga | Aug 26, 2016 | May 23, 2016 |
| Gentoo Linux | — | Upgrade net-misc/quagga. | Oct 30, 2017 | May 23, 2016 |
| Huawei Euleros 2_0_sp2 | — | Upgrade quagga | Dec 4, 2019 | May 23, 2016 |
| Huawei Euleros 2_0_sp3 | — | Upgrade quagga | Dec 18, 2019 | May 23, 2016 |
| Huawei Euleros 2_0_sp5 | — | Upgrade quagga | Feb 3, 2021 | May 23, 2016 |
| Oracle Solaris | — | Upgrade system/network/routing/quagga to version 0.99.19-0.175.3.18.0.2.0 on Solaris 11.3 | May 29, 2017 | May 23, 2016 |
| Oracle_linux | — | Upgrade quagga-develUpgrade quagga-contribUpgrade quagga | Mar 28, 2017 | Apr 27, 2016 |
| Redhat_linux | — | Upgrade quaggaNo solution existsUpgrade quagga-debuginfoUpgrade quagga-develUpgrade quagga-contrib | Mar 26, 2017 | May 23, 2016 |
| Suse | — | Upgrade quaggaUpgrade libospf0Upgrade libquagga_pb0Upgrade libzebra1Upgrade libfpm_pb0Upgrade libospfapiclient0Upgrade quagga-devel | May 23, 2016 | May 23, 2016 |
| Ubuntu | — | Upgrade quagga | Oct 13, 2016 | May 23, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub