PT-2011-1175 · Quagga+1 · Quagga+1
Published
2011-03-29
·
Updated
2024-06-15
·
CVE-2010-1674
CVSS v2.0
7.5
High
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Quagga versions prior to 0.99.20
Quagga versions prior to 0.99.18
Description
The issue concerns multiple vulnerabilities in the Quagga package that can be exploited remotely, potentially leading to breaches of confidentiality, integrity, and availability of protected information. Specifically, the extended-community parser in bgpd is vulnerable to a denial of service (NULL pointer dereference and application crash) via a malformed Extended Communities attribute.
Recommendations
For Quagga versions prior to 0.99.20, update to version 0.99.20 or later to resolve the issue.
For Quagga versions prior to 0.99.18, update to version 0.99.18 or later to prevent a denial of service (NULL pointer dereference and application crash) via a malformed Extended Communities attribute.
As a temporary workaround, consider restricting access to the bgpd service to minimize the risk of exploitation.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Quagga
Red Hat