PT-2016-4668 · Quagga+5 · Quagga+5

David Lamparter · Publicado 2016-10-18 · Atualizado 2024-06-15 · CVE-2016-1245

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Quagga versions prior to 1.0.20161017

Description A stack-based buffer overflow issue was found in the zebra daemon when processing IPv6 Neighbor Discovery messages. The root cause of this issue is the reliance on BUFSIZ, which is system-dependent, to be compatible with a message size.

Recommendations For versions prior to 1.0.20161017, update to version 1.0.20161017 or later to resolve the issue.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

ALT-PU-2017-2400

CESA-2017_0794

CVE-2016-1245

DLA-662-1

DSA-3695-1

MGASA-2016-0374

OPENSUSE-SU-2016_2617-1

OPENSUSE-SU-2016_2646-1

OPENSUSE-SU-2024:10362-1

RHSA-2017:0794

RHSA-2017_0794

SUSE-SU-2016:2569-1

SUSE-SU-2016:2618-1

SUSE-SU-2016_2569-1

SUSE-SU-2016_2618-1

SUSE-SU-2017:2294-1

SUSE-SU-2017_2294-1

USN-3110-1

Produtos afetados

Alt Linux

Centos

Quagga

Red Hat

Suse

Ubuntu

Referências · 37

• https://github.com/Quagga/quagga/commit/cfb1fae25f8c092e0d17073eaf7bd428ce1cd546 · Correção
• https://osv.dev/vulnerability/SUSE-SU-2016:2569-1 · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-3110-1 · Aviso do Fabricante
• https://advisories.mageia.org/MGASA-2016-0374.html · Nota de Segurança
• https://suse.com/security/cve/CVE-2013-2236 · Nota
• https://suse.com/support/update/announcement/2016/suse-su-20162618-1 · Nota
• http://rhn.redhat.com/errata/RHSA-2017-0794.html · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2016-1245 · Nota
• https://debian.org/security/2016/dsa-3695 · Aviso do Fabricante
• https://bugzilla.suse.com/1021669 · Nota
• https://bugzilla.suse.com/1005258 · Nota
• https://suse.com/security/cve/CVE-2017-5495 · Nota
• https://osv.dev/vulnerability/SUSE-SU-2017:2294-1 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-1245 · Nota de Segurança
• https://suse.com/security/cve/CVE-2010-1675 · Nota