PT-2003-1884 · Quagga+1 · Quagga+1

Jonny Robertson · Published 2003-11-18 · Updated 2016-10-18 · CVE-2003-0795

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions: Quagga versions prior to 0.96.4 Zebra versions prior to 0.93b

Description: The issue allows remote attackers to cause a denial of service (crash) via a malformed telnet command to the telnet CLI port, which may trigger a null dereference. This occurs because the vty layer does not verify that sub-negotiation is taking place when processing the SE marker.

Recommendations: For Quagga versions prior to 0.96.4, update to version 0.96.4 or later to resolve the issue. For Zebra versions prior to 0.93b, update to version 0.93b or later to resolve the issue. As a temporary workaround, consider restricting access to the telnet CLI port until a patch is available.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2003-0795

Affected Products

Quagga

Zebra

References · 7

• 🔥 https://exploit-db.com/exploits/23375 · Exploit
• http://secunia.com/advisories/10563 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2003-307.html · Vendor Advisory
• http://debian.org/security/2004/dsa-415 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2003-305.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2003-0795 · Security Note
• http://marc.info/?l=bugtraq&m=106883387304266&w=2 · Note