PT-2017-3182 · Quagga+3 · Quagga+3

Published 2017-09-08 · Updated 2024-06-15 · CVE-2017-16227

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Quagga versions prior to 1.2.2

Description The issue is related to the aspath put function in bgpd/bgp aspath.c, which allows remote attackers to cause a denial of service (session drop) via BGP UPDATE messages. This is due to incorrect AS PATH size calculation for long paths, where certain bytes are counted twice, resulting in an invalid message.

Recommendations For versions prior to 1.2.2, update to version 1.2.2 or later to resolve the issue. As a temporary workaround, consider restricting the handling of BGP UPDATE messages to minimize the risk of exploitation.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2017-2400

BDU:2017-02603

CVE-2017-16227

DLA-1152-1

DSA-4011-1

MGASA-2017-0416

OPENSUSE-SU-2018_0473-1

OPENSUSE-SU-2024:11290-1

SUSE-SU-2018:0455-1

SUSE-SU-2018:0456-1

SUSE-SU-2018:0457-1

SUSE-SU-2018_0455-1

SUSE-SU-2018_0456-1

SUSE-SU-2018_0457-1

USN-3471-1

Affected Products

Alt Linux

Quagga

Suse

Ubuntu

References · 48

• https://bdu.fstec.ru/vul/2017-02603 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2018:0456-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2017-0416 · Vendor Advisory
• https://bugs.debian.org/879474 · Patch
• https://cve.org/CVERecord?id=CVE-2017-16227 · Security Note
• https://lists.quagga.net/pipermail/quagga-dev/2017-September/033284.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2017-16227 · Security Note
• https://ubuntu.com/security/notices/USN-3471-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11290-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:0457-1 · Vendor Advisory
• https://git.savannah.gnu.org/cgit/quagga.git/commit/?id=7a42b78be9a4108d98833069a88e6fddb9285008 · Patch
• https://osv.dev/vulnerability/CVE-2017-16227 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:0455-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3471-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-16227 · Vendor Advisory