PT-2023-26344 · Openbsd+1 · Openbgpd+1

Greyface-On · Publicado 2023-08-29 · Atualizado 2023-09-07 · CVE-2023-38283

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenBGPD versions prior to 8.1

Description The issue arises from incorrect handling of BGP update data, specifically the length of path attributes, which can be set by a potentially distant remote actor. This may cause the system to incorrectly reset a session.

Recommendations For OpenBGPD versions prior to 8.1, update to OpenBSD 7.3 errata 006 to resolve the issue.

Exploit

Correção

Improper Check for Exceptional Conditions

Enumeração de Fraquezas

CWE-754

Identificadores relacionados

CVE-2023-38283

Produtos afetados

Debian

Openbgpd

Referências · 18

• 🔥 https://blog.benjojo.co.uk/post/bgp-path-attributes-grave-error-handling · Exploit
• https://github.com/openbgpd-portable/openbgpd-portable/releases/tag/8.1 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-38283 · Aviso do Fabricante
• https://t.me/cibsecurity/69359 · Publicação no Telegram
• https://cve.org/CVERecord?id=CVE-2023-38283 · Nota de Segurança
• https://openbsd.org/errata73.html · Nota
• https://osv.dev/vulnerability/CVE-2023-38283 · Aviso do Fabricante
• https://news.ycombinator.com/item?id=37305800 · Nota
• https://twitter.com/fletch_ai/status/1698865282184261954 · Publicação no Twitter
• https://t.me/cvenotify/57745 · Publicação no Telegram
• https://t.me/cvenotify/57554 · Publicação no Telegram
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-38283 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-38283 · Nota de Segurança
• https://ftp.openbsd.org/pub/OpenBSD/patches/7.3/common/006_bgpd.patch.sig · Correção
• https://twitter.com/CVEnew/status/1696547900174561447 · Publicação no Twitter