PT-2019-17850 · Frrouting · Frrouting Frr

Donald Sharpsharp · Publicado 2019-01-10 · Atualizado 2020-08-24 · CVE-2019-5892

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions FRRouting FRR versions 2.x through 3.x before 3.0.4 FRRouting FRR versions 4.x before 4.0.1 FRRouting FRR versions 5.x before 5.0.2 FRRouting FRR versions 6.x before 6.0.2

Description The issue allows remote attackers to cause a denial of service, specifically a peering session flap, via attribute 255 in a BGP UPDATE packet when ENABLE BGP VNC is used for Virtual Network Control. This occurred because FRR does not implement RFC 7606, resulting in packets with 255 being considered invalid VNC data and the BGP session being closed.

Recommendations For versions 2.x through 3.x before 3.0.4, update to version 3.0.4 or later. For versions 4.x before 4.0.1, update to version 4.0.1 or later. For versions 5.x before 5.0.2, update to version 5.0.2 or later. For versions 6.x before 6.0.2, update to version 6.0.2 or later.

Correção

Enumeração de Fraquezas

CWE-436

Identificadores relacionados

CVE-2019-5892

Produtos afetados

Frrouting Frr

Referências · 9

• https://github.com/FRRouting/frr/releases/tag/frr-5.0.2 · Nota
• https://github.com/FRRouting/frr/commit/943d595a018e69b550db08cccba1d0778a86705a · Correção
• https://github.com/FRRouting/frr/releases/tag/frr-6.0.2 · Nota
• https://github.com/FRRouting/frr/releases/tag/frr-4.0.1 · Nota
• https://github.com/FRRouting/frr/releases/tag/frr-3.0.4 · Nota
• https://lists.frrouting.org/pipermail/frog/2019-January/000404.html · Aviso do Fabricante
• https://frrouting.org/community/security/cve-2019-5892.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-5892 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-5892 · Aviso do Fabricante