PT-2007-1066 · Quagga+1 · Quagga+1
Publicado
2007-04-12
·
Atualizado
2024-06-15
·
CVE-2007-1995
CVSS v2.0
6.3
Média
| Vetor | AV:N/AC:M/Au:S/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions:
Quagga versions 0.98.6 and earlier
Quagga versions 0.99.6 and earlier
Description:
The issue allows remote attackers to cause a denial of service, potentially leading to a daemon crash or exit, by sending crafted UPDATE messages that trigger an assertion error or out of bounds read. This is due to the lack of validation of length values in the MP REACH NLRI and MP UNREACH NLRI attributes. The vulnerability can be exploited remotely by an attacker who has passed the authentication procedure, leading to a disruption of protected information availability.
Recommendations:
For Quagga versions 0.98.6 and earlier: update to a version later than 0.98.6 to resolve the issue.
For Quagga versions 0.99.6 and earlier: update to a version later than 0.99.6 to resolve the issue.
As a temporary workaround, consider restricting access to the
bgpd/bgp attr.c module until a patch is available.Correção
DoS
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Quagga
Red Hat