Published: 19/02/2018 Updated: 09/10/2019

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 668

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

The Quagga BGP daemon (bgpd) prior to version 1.2.3 can double-free memory when processing certain forms of UPDATE message, containing cluster-list and/or unknown attributes. A successful attack could cause a denial of service or potentially allow an malicious user to execute arbitrary code.

Vulnerable Product	Search on Vulmon	Subscribe to Product
quagga quagga
debian debian linux 7.0
debian debian linux 8.0
debian debian linux 9.0
canonical ubuntu linux 14.04
canonical ubuntu linux 17.10
canonical ubuntu linux 16.04
redhat enterprise linux server 7.0
redhat enterprise linux workstation 7.0
redhat enterprise linux server aus 7.6
redhat enterprise linux server eus 7.5
redhat enterprise linux server eus 7.6
redhat enterprise linux server tus 7.4
redhat enterprise linux server tus 7.6
redhat enterprise linux server aus 7.4
redhat enterprise linux server eus 7.4
siemens ruggedcom_rox_ii_firmware

Synopsis Important: quagga security update Type/Severity Security Advisory: Important Topic An update for quagga is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base score, w ...

Debian Bug report logs - #890563 quagga: CVE-2018-5378 CVE-2018-5379 CVE-2018-5380 CVE-2018-5381 Package: src:quagga; Maintainer for src:quagga is Brett Parker <iDunno@sommitrealweirdcouk>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Thu, 15 Feb 2018 22:42:05 UTC Severity: serious Tags: fixed-upstre ...

Several security issues were fixed in Quagga ...

Several vulnerabilities have been discovered in Quagga, a routing daemon The Common Vulnerabilities and Exposures project identifies the following issues: CVE-2018-5378 It was discovered that the Quagga BGP daemon, bgpd, does not properly bounds check data sent with a NOTIFY to a peer, if an attribute length is invalid A configured B ...

Infinite loop issue triggered by invalid OPEN message allows denial-of-serviceAn infinite loop vulnerability was discovered in Quagga A BGP peer could send specially crafted packets that would cause the daemon to enter an infinite loop, denying service and consuming CPU until it is restarted(CVE-2018-5381) Double free vulnerability in bgpd when p ...

A double-free vulnerability was found in Quagga A BGP peer could send a specially crafted UPDATE message which would cause allocated blocks of memory to be free()d more than once, potentially leading to a crash or other issues ...

CWE-415 https://gogs.quagga.net/Quagga/quagga/src/master/doc/security/Quagga-2018-1114.txt http://www.kb.cert.org/vuls/id/940439 http://savannah.nongnu.org/forum/forum.php?forum_id=9095 https://www.debian.org/security/2018/dsa-4115 https://lists.debian.org/debian-lts-announce/2018/02/msg00021.html http://www.securityfocus.com/bid/103105 https://access.redhat.com/errata/RHSA-2018:0377 https://usn.ubuntu.com/3573-1/https://security.gentoo.org/glsa/201804-17 https://cert-portal.siemens.com/productcert/pdf/ssa-451142.pdf https://access.redhat.com/errata/RHSA-2018:0377 https://usn.ubuntu.com/3573-1/https://nvd.nist.gov https://www.kb.cert.org/vuls/id/940439

CVE-2018-5379

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect