The bgp_dump_routes_func function in bgpd/bgp_dump.c in Quagga does not perform size checks when dumping data, which might allow remote attackers to cause a denial of service (assertion failure and daemon crash) via a large BGP packet.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade quagga-develUpgrade quaggaUpgrade quagga-contribUpgrade quagga-debuginfo | Aug 28, 2019 | May 23, 2016 |
| Debian | — | Upgrade quagga | Aug 26, 2016 | May 23, 2016 |
| Gentoo Linux | — | Upgrade net-misc/quagga. | Oct 30, 2017 | May 23, 2016 |
| Huawei Euleros 2_0_sp2 | — | Upgrade quagga | Dec 4, 2019 | May 23, 2016 |
| Huawei Euleros 2_0_sp3 | — | Upgrade quagga | Dec 18, 2019 | May 23, 2016 |
| Huawei Euleros 2_0_sp5 | — | Upgrade quagga | Feb 3, 2021 | May 23, 2016 |
| Oracle Solaris | — | Upgrade system/network/routing/quagga to version 0.99.19-0.175.3.18.0.2.0 on Solaris 11.3 | May 29, 2017 | May 23, 2016 |
| Oracle_linux | — | Upgrade quagga-develUpgrade quaggaUpgrade quagga-contrib | Mar 28, 2017 | Apr 27, 2016 |
| Redhat_linux | — | Upgrade quagga-contribUpgrade quagga-develUpgrade quaggaNo solution existsUpgrade quagga-debuginfo | Mar 26, 2017 | May 23, 2016 |
| Suse | — | Upgrade libzebra1Upgrade libospfapiclient0Upgrade quagga-develUpgrade libfpm_pb0Upgrade quaggaUpgrade libquagga_pb0Upgrade libospf0 | May 23, 2016 | May 23, 2016 |
| Ubuntu | — | Upgrade quagga | Oct 13, 2016 | May 23, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub