Published: 10/09/2010 Updated: 13/02/2023

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

bgpd in Quagga prior to 0.99.17 does not properly parse AS paths, which allows remote malicious users to cause a denial of service (NULL pointer dereference and daemon crash) via an unknown AS type in an AS path attribute in a BGP UPDATE message.

Vulnerable Product	Search on Vulmon	Subscribe to Product
quagga quagga 0.99.11
quagga quagga 0.99.2
quagga quagga 0.97.5
quagga quagga 0.95
quagga quagga 0.98.3
quagga quagga 0.96.3
quagga quagga 0.99.4
quagga quagga 0.99.7
quagga quagga 0.99.14
quagga quagga 0.99.5
quagga quagga 0.96.5
quagga quagga 0.98.0
quagga quagga
quagga quagga 0.96.1
quagga quagga 0.98.1
quagga quagga 0.96.4
quagga quagga 0.98.5
quagga quagga 0.97.3
quagga quagga 0.99.3
quagga quagga 0.99.13
quagga quagga 0.99.6
quagga quagga 0.98.6
quagga quagga 0.97.4
quagga quagga 0.98.4
quagga quagga 0.99.12
quagga quagga 0.98.2
quagga quagga 0.97.1
quagga quagga 0.97.0
quagga quagga 0.96.2
quagga quagga 0.99.9
quagga quagga 0.99.1
quagga quagga 0.97.2
quagga quagga 0.99.15
quagga quagga 0.99.10
quagga quagga 0.99.8
quagga quagga 0.96

Debian Bug report logs - #594262 quagga: Two BGP security problems fixed in 09917 Package: quagga; Maintainer for quagga is Brett Parker <iDunno@sommitrealweirdcouk>; Source for quagga is src:quagga (PTS, buildd, popcon) Reported by: Christian Hammers <ch@debianorg> Date: Tue, 24 Aug 2010 23:21:02 UTC Severity: ...

It was discovered that Quagga incorrectly handled certain Outbound Route Filtering (ORF) records A remote authenticated attacker could use this flaw to cause a denial of service or potentially execute arbitrary code The default compiler options for Ubuntu 804 LTS and later should reduce the vulnerability to a denial of service (CVE-2010-2948) ...

NVD-CWE-Other http://www.vupen.com/english/advisories/2010/2304 http://www.quagga.net/news2.php?y=2010&m=8&d=19 http://secunia.com/advisories/41238 http://www.openwall.com/lists/oss-security/2010/08/25/4 http://www.debian.org/security/2010/dsa-2104 https://bugzilla.redhat.com/show_bug.cgi?id=626795 http://www.openwall.com/lists/oss-security/2010/08/24/3 http://www.securityfocus.com/bid/42642 http://secunia.com/advisories/41038 http://www.mandriva.com/security/advisories?name=MDVSA-2010:174 http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00006.html http://secunia.com/advisories/42397 http://www.vupen.com/english/advisories/2010/3097 http://secunia.com/advisories/42498 http://www.vupen.com/english/advisories/2010/3124 http://www.ubuntu.com/usn/USN-1027-1 http://www.redhat.com/support/errata/RHSA-2010-0945.html http://secunia.com/advisories/42446 http://lists.opensuse.org/opensuse-security-announce/2011-12/msg00009.html http://security.gentoo.org/glsa/glsa-201202-02.xml http://secunia.com/advisories/48106 http://code.quagga.net/?p=quagga.git%3Ba=commit%3Bh=cddb8112b80fa9867156c637d63e6e79eeac67bb https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=594262 https://usn.ubuntu.com/1027-1/https://nvd.nist.gov

CVE-2010-2949

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect