PT-2019-17850 · Frrouting · Frrouting Frr

Donald Sharpsharp · Published 2019-01-10 · Updated 2020-08-24 · CVE-2019-5892

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions FRRouting FRR versions 2.x through 3.x before 3.0.4 FRRouting FRR versions 4.x before 4.0.1 FRRouting FRR versions 5.x before 5.0.2 FRRouting FRR versions 6.x before 6.0.2

Description The issue allows remote attackers to cause a denial of service, specifically a peering session flap, via attribute 255 in a BGP UPDATE packet when ENABLE BGP VNC is used for Virtual Network Control. This occurred because FRR does not implement RFC 7606, resulting in packets with 255 being considered invalid VNC data and the BGP session being closed.

Recommendations For versions 2.x through 3.x before 3.0.4, update to version 3.0.4 or later. For versions 4.x before 4.0.1, update to version 4.0.1 or later. For versions 5.x before 5.0.2, update to version 5.0.2 or later. For versions 6.x before 6.0.2, update to version 6.0.2 or later.

Fix

Weakness Enumeration

CWE-436

Related Identifiers

CVE-2019-5892

Affected Products

Frrouting Frr

References · 9

• https://github.com/FRRouting/frr/commit/943d595a018e69b550db08cccba1d0778a86705a · Patch
• https://lists.frrouting.org/pipermail/frog/2019-January/000404.html · Vendor Advisory
• https://frrouting.org/community/security/cve-2019-5892.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-5892 · Security Note
• https://osv.dev/vulnerability/CVE-2019-5892 · Vendor Advisory
• https://github.com/FRRouting/frr/releases/tag/frr-5.0.2 · Note
• https://github.com/FRRouting/frr/releases/tag/frr-6.0.2 · Note
• https://github.com/FRRouting/frr/releases/tag/frr-4.0.1 · Note
• https://github.com/FRRouting/frr/releases/tag/frr-3.0.4 · Note