Published: 19/02/2018 Updated: 09/10/2019

CVSS v2 Base Score: 4.9 | Impact Score: 4.9 | Exploitability Score: 6.8

CVSS v3 Base Score: 5.9 | Impact Score: 4.2 | Exploitability Score: 1.6

VMScore: 436

Vector: AV:N/AC:M/Au:S/C:P/I:N/A:P

The Quagga BGP daemon (bgpd) prior to version 1.2.3 does not properly bounds check the data sent with a NOTIFY to a peer, if an attribute length is invalid. Arbitrary data from the bgpd process may be sent over the network to a peer and/or bgpd may crash.

Vulnerable Product	Search on Vulmon	Subscribe to Product
quagga quagga
debian debian linux 9.0
debian debian linux 8.0
canonical ubuntu linux 14.04
canonical ubuntu linux 16.04
canonical ubuntu linux 17.10

Several security issues were fixed in Quagga ...

Debian Bug report logs - #890563 quagga: CVE-2018-5378 CVE-2018-5379 CVE-2018-5380 CVE-2018-5381 Package: src:quagga; Maintainer for src:quagga is Brett Parker <iDunno@sommitrealweirdcouk>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Thu, 15 Feb 2018 22:42:05 UTC Severity: serious Tags: fixed-upstre ...

Several vulnerabilities have been discovered in Quagga, a routing daemon The Common Vulnerabilities and Exposures project identifies the following issues: CVE-2018-5378 It was discovered that the Quagga BGP daemon, bgpd, does not properly bounds check data sent with a NOTIFY to a peer, if an attribute length is invalid A configured B ...

An out-of-bounds read vulnerability was discovered in Quagga A BGP peer could send a specially crafted message which would cause Quagga to read out of bounds, potentially causing a crash or disclosure of up to 64KB process memory to the peer ...

CWE-119 https://gogs.quagga.net/Quagga/quagga/src/master/doc/security/Quagga-2018-0543.txt http://www.kb.cert.org/vuls/id/940439 http://savannah.nongnu.org/forum/forum.php?forum_id=9095 https://www.debian.org/security/2018/dsa-4115 https://usn.ubuntu.com/3573-1/https://security.gentoo.org/glsa/201804-17 https://usn.ubuntu.com/3573-1/https://nvd.nist.gov https://www.kb.cert.org/vuls/id/940439

CVE-2018-5378

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect