PT-2017-3182 · Quagga+3 · Quagga+3
Publicado
2017-09-08
·
Atualizado
2024-06-15
·
CVE-2017-16227
CVSS v3.1
7.5
Alta
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Quagga versions prior to 1.2.2
Description
The issue is related to the aspath put function in bgpd/bgp aspath.c, which allows remote attackers to cause a denial of service (session drop) via BGP UPDATE messages. This is due to incorrect AS PATH size calculation for long paths, where certain bytes are counted twice, resulting in an invalid message.
Recommendations
For versions prior to 1.2.2, update to version 1.2.2 or later to resolve the issue. As a temporary workaround, consider restricting the handling of BGP UPDATE messages to minimize the risk of exploitation.
Correção
DoS
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Quagga
Suse
Ubuntu