PT-2023-2881 · Frrouting+3 · Frrouting Frr-Bgpd+3
Cjt
+1
·
Publicado
2023-04-03
·
Atualizado
2024-04-03
·
CVE-2022-36440
CVSS v2.0
7.8
Alta
| Vetor | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Frrouting frr-bgpd version 8.3.0
Description
A reachable assertion was found in the
peek for as4 capability function, which can be exploited by attackers to maliciously construct BGP open packets and send them to BGP peers running frr-bgpd, resulting in a denial of service. The issue is related to the insufficient use of the assert() function. This can allow a remote attacker to cause a service disruption.Recommendations
For Frrouting frr-bgpd version 8.3.0, as a temporary workaround, consider disabling the
peek for as4 capability function until a patch is available. Restrict access to the BGP peers to minimize the risk of exploitation. Avoid using the vulnerable function in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
DoS
Assertion Failure
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Almalinux
Frrouting Frr-Bgpd
Red Hat
Red Os